{"record":{"id":"a61a0c436f65fe29","repo":"rancher/rancher","slug":"saml-search-get-principals-search-error-s","errorCode":null,"errorMessage":"saml search get principals search error: %s","messagePattern":"saml search get principals search error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":500,"severity":"error","filePath":"pkg/auth/providers/ldap/ldap_provider.go","lineNumber":381,"sourceCode":"\t\t\tconfig.GetUserSearchAttributes(ObjectClass),\n\t\t)\n\t} else {\n\t\tfilter := fmt.Sprintf(\n\t\t\t\"(&(%s=%s)(%s=%s))\",\n\t\t\tObjectClass, ldap.SanitizeAttr(config.GroupObjectClass),\n\t\t\tconfig.GroupDNAttribute, ldapv3.EscapeFilter(externalID),\n\t\t)\n\n\t\tsearchRequest = ldap.NewWholeSubtreeSearchRequest(\n\t\t\tconfig.GroupSearchBase,\n\t\t\tfilter,\n\t\t\tconfig.GetGroupSearchAttributes(ObjectClass),\n\t\t)\n\t}\n\n\tresult, err := lConn.Search(searchRequest)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"saml search get principals search error: %s\", err)\n\t}\n\n\tif len(result.Entries) < 1 {\n\t\treturn nil, fmt.Errorf(\"no identities can be retrieved\")\n\t} else if len(result.Entries) > 1 {\n\t\treturn nil, fmt.Errorf(\"more than one result found\")\n\t}\n\n\tentry := result.Entries[0]\n\tentryAttributes := entry.Attributes\n\n\tif scope == p.userScope {\n\t\tuserLoginValues := ldap.GetAttributeValuesByName(entry.Attributes, config.UserLoginAttribute)\n\t\tif len(userLoginValues) > 0 {\n\t\t\texternalID = userLoginValues[0] // only support first\n\t\t}\n\t} else {\n\t\tgroupDNValues := ldap.GetAttributeValuesByName(entry.Attributes, config.GroupDNAttribute)","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/ldap/ldap_provider.go#L363-L399","documentation":"The LDAP search inside samlSearchGetPrincipal (used when a SAML provider delegates user/group lookup to LDAP) failed at the protocol level: the server returned an error for the whole-subtree search under the user or group search base. The wrapped %s text carries the directory error (operations error, size/time limit, unavailable, invalid syntax).","triggerScenarios":"lConn.Search on the built filter fails: service account lacks rights on the search base, server-side size/time limits exceeded, filter syntax invalid for the directory (e.g. UserLoginAttribute containing characters needing escaping in the DN-attribute branch), or the directory is under load/unavailable.","commonSituations":"Service account permissions scoped only to a subtree while GroupSearchBase sits outside it; large directories exceeding the search limit; attribute names wrong for the schema (mail vs userPrincipalName).","solutions":["Read the wrapped error string - operationsError usually means bind/permissions, adminLimitExceeded means size/time limit","Run the equivalent ldapsearch as the service account against the same base and filter","Fix attribute names / search bases in the LDAP config or raise server-side limits","Verify the service account can read both UserSearchBase and GroupSearchBase"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-flight the exact search the SAML path will run\nres, err := conn.Search(ldap.NewWholeSubtreeSearchRequest(base, filter, attrs))\nif err != nil {\n    return fmt.Errorf(\"directory rejected search (permissions/limits?): %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"saml search get principals search error\") {\n    // unwrap: operationsError => service-account rights; adminLimitExceeded => raise limits\n    return diagnoseSearchFailure(err)\n}","preventionTips":["Grant the service account read on both user and group search bases","Raise or paginate around server size/time limits for large directories","Keep filter attribute names aligned with the actual directory schema"],"tags":["saml","ldap","search","service-account","limits"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}