{"record":{"id":"9f2e37c9fd129680","repo":"open-webui/open-webui","slug":"user-record-mismatch","errorCode":null,"errorMessage":"User record mismatch.","messagePattern":"User record mismatch\\.","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"backend/open_webui/routers/auths.py","lineNumber":702,"sourceCode":"                    raise HTTPException(500, detail='Internal error occurred during LDAP user creation.')\n\n            user = await Auths.authenticate_user_by_email(email, db=db)\n\n            if user:\n                if ENABLE_LDAP_GROUP_MANAGEMENT and user_groups:\n                    try:\n                        if ENABLE_LDAP_GROUP_CREATION:\n                            await Groups.create_groups_by_group_names(user.id, user_groups, db=db)\n                        await Groups.sync_groups_by_group_names(user.id, user_groups, db=db)\n                        log.info(f'Successfully synced groups for user {user.id}: {user_groups}')\n                    except Exception as e:\n                        log.error(f'Failed to sync groups for user {user.id}: {e}')\n\n                return await create_session_response(request, user, db, response, set_cookie=True, source='ldap')\n            else:\n                raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)\n        else:\n            raise HTTPException(400, 'User record mismatch.')\n    except Exception as e:\n        log.error(f'LDAP authentication error: {str(e)}')\n        raise HTTPException(400, detail='LDAP authentication failed.')\n\n\n############################\n# SignIn\n############################\n\n\n@router.post('/signin', response_model=SessionUserResponse)\nasync def signin(\n    request: Request,\n    response: Response,\n    form_data: SigninForm,\n    db: AsyncSession = Depends(get_async_session),\n):\n    if not ENABLE_PASSWORD_AUTH:","sourceCodeStart":684,"sourceCodeEnd":720,"githubUrl":"https://github.com/open-webui/open-webui/blob/01f4282f1ffe0d6212f58d3afbeae21fffd0c4be/backend/open_webui/routers/auths.py#L684-L720","documentation":"Raised (400) when the lowercased submitted username is not present in username_list — the list of values of the entry's username attribute (lowercased). The user was found by the earlier search filter, but the attribute values on the returned entry don't actually contain the typed username, e.g. because the search matched on a different attribute than the one used for this final comparison.","triggerScenarios":"Search filter matches via a custom ldap.server.search_filter clause (e.g. on mail or employeeID) but attribute_for_username holds a different value; attribute_for_username is multi-valued and the typed name matches only one variant with different casing/spacing; directory data inconsistency between the indexed filter attribute and the stored attribute values.","commonSituations":"Configuring search_filter='(mail=*domain.com)' while users log in with a value not in the sAMAccountName/uid list; trailing spaces or case in directory values after a migration; attribute renamed in AD after a domain consolidation.","solutions":["Inspect the user's entry and compare attribute values with the typed login name: ldapsearch showing attribute_for_username values","Align ldap.server.search_filter and attribute_for_username so both refer to the same attribute the users type","Normalize directory data (trim/case) so lowercased comparison succeeds","Have users log in with the exact value stored in attribute_for_username"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# assert the typed username appears in the entry's attribute values\nvals = [str(v).lower() for v in ([entry[attr].value] if not isinstance(entry[attr].value, list) else entry[attr].value)]\nassert form_user.lower() in vals, 'search_filter and attribute_for_username are inconsistent'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the same attribute in search_filter and attribute_for_username","Document the exact login-name format users must use","Audit directory values for case/whitespace drift after migrations"],"tags":["ldap","attribute-mapping","configuration"],"backgroundTag":null,"analyzedSha":"01f4282f1ffe0d6212f58d3afbeae21fffd0c4be","analyzedAt":"2026-08-14T18:25:22.715Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}