{"record":{"id":"dbc954e6d77a332c","repo":"SonarSource/sonarqube","slug":"unable-to-retrieve-groups-for-user-s-in-server-wi","errorCode":null,"errorMessage":"Unable to retrieve groups for user %s in server with key <%s>","messagePattern":"Unable to retrieve groups for user (.+?) in server with key <(.+?)>","errorType":"exception","errorClass":"LdapException","httpStatus":null,"severity":"error","filePath":"server/sonar-auth-ldap/src/main/java/org/sonar/auth/ldap/DefaultLdapGroupsProvider.java","lineNumber":75,"sourceCode":"  @Override\n  public Collection<String> doGetGroups(Context context) {\n    return getGroups(context.serverKey(), context.username());\n  }\n\n  private Collection<String> getGroups(String serverKey, String username) {\n    checkPrerequisites(username);\n    Set<String> groups = new HashSet<>();\n    if (groupMappings.containsKey(serverKey)) {\n      SearchResult searchResult = searchUserGroups(username, serverKey);\n      if (searchResult != null) {\n        try {\n          NamingEnumeration<SearchResult> result = groupMappings\n            .get(serverKey)\n            .createSearch(contextFactories.get(serverKey), searchResult).find();\n          groups.addAll(mapGroups(serverKey, result));\n        } catch (NamingException e) {\n          LOG.debug(e.getMessage(), e);\n          throw new LdapException(format(\"Unable to retrieve groups for user %s in server with key <%s>\", username, serverKey), e);\n        }\n      }\n    }\n    return groups;\n  }\n\n  private void checkPrerequisites(String username) {\n    if (userMappings.isEmpty() || groupMappings.isEmpty()) {\n      throw new LdapException(format(\"Unable to retrieve details for user %s: No user or group mapping found.\", username));\n    }\n  }\n\n  private SearchResult searchUserGroups(String username, String serverKey) {\n    try {\n      LOG.debug(\"Requesting groups for user {}\", username);\n      return userMappings.get(serverKey).createSearch(contextFactories.get(serverKey), username)\n        .returns(groupMappings.get(serverKey).getRequiredUserAttributes())\n        .findUnique();","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-auth-ldap/src/main/java/org/sonar/auth/ldap/DefaultLdapGroupsProvider.java#L57-L93","documentation":"sonar-auth-ldap wraps any javax.naming.NamingException raised while enumerating a user's groups against an LDAP server in this LdapException. The library searched the group mapping for the given LDAP server key, and the underlying directory operation (bind, search, or attribute read) failed. The original NamingException is logged at debug level and attached as the cause.","triggerScenarios":"Calling getGroups (via doGetGroups) for a username whose group search on server with key <serverKey> throws a NamingException — e.g. group search base DN wrong, group objectClass/filter mismatch, network failure to the LDAP server, or anonymous bind not permitted to read group entries.","commonSituations":"Typo in sonar.authenticator.ldap.group.* settings; group search requires credentials the bind user lacks; LDAP server briefly unreachable; user not found so the group search enumerates over a null/failed result; multi-server setups where only one server has a valid group mapping.","solutions":["Enable debug logging to see the underlying NamingException cause (LOG.debug prints it) and fix the root cause (bad DN, filter, or connection).","Verify sonar.authenticator.ldap.group.baseDn, group.objectClass, group.idAttribute match the actual directory schema.","Check network reachability and bind credentials with an ldapsearch command equivalent to the configured group search.","Confirm the serverKey used exists in sonar.authenticator.ldap.servers and has both user and group mappings configured."],"exampleFix":"// before: group mapping pointing at wrong base\nsonar.authenticator.ldap.group.baseDn: cn=banks,dc=example,dc=org\n// after: correct group container\nsonar.authenticator.ldap.group.baseDn: cn=groups,dc=example,dc=org","handlingStrategy":"try-catch","validationCode":"// before calling getGroups, verify LDAP group search works\nConfig config = ...; // sonar config\nif (!config.hasKey(\"sonar.authenticator.ldap.group.baseDn\")) {\n  throw new IllegalStateException(\"group.baseDn not configured; skip group sync\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  groups = ldapGroupsProvider.getGroups(username);\n} catch (LdapException e) {\n  LOG.warn(\"Group retrieval failed for {} (check cause NamingException): {}\", username, e.getMessage());\n  groups = Collections.emptyList(); // degrade gracefully\n}","preventionTips":["Always enable debug logging for org.sonar.auth.ldap in pre-production to catch the root NamingException.","Validate group baseDn/objectClass against your directory schema with ldapsearch before deployment.","Monitor LDAP server availability from the SonarQube host."],"tags":["ldap","group-lookup","naming-exception","directory-search"],"backgroundTag":"http-request-failed","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}