{"record":{"id":"ae42eacd470adddc","repo":"passbolt/passbolt_api","slug":"using-callbacks-for-groupcustomfilter-is-not-supported","errorCode":null,"errorMessage":"Using callbacks for groupCustomFilter is not supported anymore. Please use LDAP search filter instead.","messagePattern":"Using callbacks for groupCustomFilter is not supported anymore\\. Please use LDAP search filter instead\\.","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"plugins/PassboltEe/DirectorySync/src/Utility/LdapDirectory.php","lineNumber":581,"sourceCode":"            }\n        }\n\n        return $query;\n    }\n\n    /**\n     * Customize groups query as per configuration (if available).\n     *\n     * @param \\LdapRecord\\Query\\Builder $query query\n     * @return \\LdapRecord\\Query\\Builder\n     * @throws \\InvalidArgumentException If groupCustomFilter callback is used.\n     * @throws \\InvalidArgumentException If groupCustomFilter cannot be parsed.\n     */\n    private function _customizeGroupsQuery(Builder $query): Builder\n    {\n        $groupCustomFilter = $this->directorySettings->getGroupCustomFilters();\n        if (is_callable($groupCustomFilter)) {\n            throw new InvalidArgumentException(\n                'Using callbacks for groupCustomFilter is not supported anymore. Please use LDAP search filter instead.'\n            );\n        } elseif (is_string($groupCustomFilter)) {\n            try {\n                $filter = Parser::parse($groupCustomFilter);\n                $query->rawFilter(Parser::assemble($filter));\n            } catch (ParserException $pe) {\n                throw new InvalidArgumentException(\n                    'An error has occurred parsing groupCustomFilter: ' . $pe->getMessage()\n                );\n            }\n        }\n\n        return $query;\n    }\n\n    /**\n     * Return filters used to retrieve users as a string, in ldapsearch format.","sourceCodeStart":563,"sourceCodeEnd":599,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/DirectorySync/src/Utility/LdapDirectory.php#L563-L599","documentation":"Same deprecation as for users but for groups: DirectorySync no longer supports callable groupCustomFilter. _customizeGroupsQuery throws this InvalidArgumentException when the stored group filter setting is a callable, requiring an LDAP search filter string instead.","triggerScenarios":"Calling _fetchAndInitializeGroupsQuery (group LDAP lookup) when directorySettings->getGroupCustomFilters() returns a callable.","commonSituations":"Legacy integrations that filtered AD/LDAP groups via a PHP callback; code left over from an older passbolt version after an upgrade.","solutions":["Replace the callable groupCustomFilter with an LDAP filter string such as '(objectClass=group)'","Delete the callback-based filter definition from the directory settings/configuration code","Re-run group sync and verify the expected groups are still matched"],"exampleFix":"// before\n$settings->setGroupCustomFilters(function (Builder $query) { $query->where(['GroupType' => 'Security']); });\n// after\n$settings->setGroupCustomFilters('(groupType=-2147483646)');","handlingStrategy":"validation","validationCode":"$filter = $this->directorySettings->getGroupCustomFilters();\nif (is_callable($filter)) {\n    throw new RuntimeException('groupCustomFilter must be an LDAP filter string, not a callback');\n}","typeGuard":"$filter = is_string($customFilter) ? $customFilter : null;","tryCatchPattern":null,"preventionTips":["Use string LDAP filters for group selection","Review legacy group filter code after upgrades","Test group sync in staging with the new filter"],"tags":["ldap","directory-sync","deprecated-api","configuration"],"backgroundTag":"deprecated-api-usage","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}