{"record":{"id":"a404454a3544a966","repo":"passbolt/passbolt_api","slug":"the-settings-provided-are-incorrect","errorCode":null,"errorMessage":"The settings provided are incorrect. ","messagePattern":"The settings provided are incorrect\\. ","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/DirectorySync/src/Controller/DirectorySettingsController.php","lineNumber":122,"sourceCode":"     *\n     * @return void\n     */\n    public function test()\n    {\n        if (!$this->User->isAdmin()) {\n            throw new ForbiddenException(__('You are not authorized to access that location.'));\n        }\n\n        $data = $this->request->getData();\n        $form = new LdapConfigurationForm();\n        if (!$form->validate($data)) {\n            $errors = $form->getErrors();\n            throw new CustomValidationException('Could not validate settings.', $errors);\n        }\n        try {\n            $form->execute($data);\n        } catch (Exception $e) {\n            throw new BadRequestException(\n                'The settings provided are incorrect. ' . $e->getMessage(),\n                null,\n                $e\n            );\n        }\n\n        try {\n            $settings = LdapConfigurationForm::formatFormDataToOrgSettings($data);\n            $orgSettings = new DirectoryOrgSettings($settings);\n            $directory = DirectoryFactory::get($orgSettings);\n            $filteredDirectoryResults = $directory->getFilteredDirectoryResults();\n            $outputData = [\n                'users' => $this->_toArray(array_values($filteredDirectoryResults->getUsers())),\n                'groups' => $this->_toArray(array_values($filteredDirectoryResults->getGroups())),\n            ];\n        } catch (Exception $e) {\n            throw new BadRequestException('The users and groups cannot be retrieved. ' . $e->getMessage());\n        }","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/DirectorySync/src/Controller/DirectorySettingsController.php#L104-L140","documentation":"Thrown when LdapConfigurationForm::execute() throws during POST /directorysync/test — the payload passed validation but the live LDAP operation performed by the form execution failed. The exception message is prefixed 'The settings provided are incorrect. ' and returned as HTTP 400, with the original exception preserved as previous.","triggerScenarios":"POST /directorysync/test where $form->execute($data) fails — e.g. cannot connect to the LDAP host, bind rejected, or the form's execute step hits an unexpected error against the real directory.","commonSituations":"Typo'd host/port; LDAP server unreachable from the passbolt server network; invalid bind credentials; LDAPS certificate not trusted; directory server rejecting anonymous bind.","solutions":["Read the full message after the prefix and the chained exception in logs for the concrete LDAP failure.","Test connectivity from the passbolt host with ldapsearch (ldap://host:389 or ldaps://host:636).","Verify bind DN/password and base DN.","Trust the LDAP server's CA certificate for LDAPS (update ca-certificates / configure LDAPTLS_CACERT).","Re-run POST /directorysync/test after each fix; it does not save settings so it is safe to iterate."],"exampleFix":"// before\n\"hosts\": \"ldaps://ldap.internal\", \"port\": 636 (untrusted self-signed cert)\n// 400 The settings provided are incorrect. Can't contact LDAP server\n// after\n# add CA cert then retry\nexport LDAPTLS_CACERT=/etc/ssl/ldap-ca.pem\n# and ensure config uses reachable host/port\n{\"directory_type\": \"ldap\", \"hosts\": \"ldap.internal\", \"port\": 636}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    await api.post('/directorysync/test.json', payload);\n} catch (e) {\n    if (e.response?.status === 400 && String(e.response.data?.message || '').startsWith('The settings provided are incorrect.')) {\n        const cause = e.response.data.message.replace('The settings provided are incorrect. ', '');\n        // cause describes the LDAP connect/bind failure; fix host/port/credentials/TLS\n    }\n    throw e;\n}","preventionTips":["Verify host, port, TLS mode and credentials from the passbolt host with ldapsearch before testing.","Trust the directory's CA certificate for LDAPS.","Ensure network/firewall rules allow the passbolt server to reach the LDAP port.","Iterate with /test since it never persists settings."],"tags":["ldap","connection","http-400","configuration"],"backgroundTag":"ldap-bind-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-22T11:17:16.035Z"}