{"record":{"id":"fff4556fa90769ef","repo":"AlistGo/alist","slug":"cannot-get-username-from-ldap-provider","errorCode":null,"errorMessage":"cannot get username from ldap provider","messagePattern":"cannot get username from ldap provider","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"server/handles/ldap_login.go","lineNumber":126,"sourceCode":"\t\t\tcommon.ErrorResp(c, err, 400)\n\t\t\tloginCache.Set(ip, count+1)\n\t\t\treturn\n\t\t}\n\t}\n\n\t// generate token\n\ttoken, err := common.GenerateToken(user)\n\tif err != nil {\n\t\tcommon.ErrorResp(c, err, 400, true)\n\t\treturn\n\t}\n\tcommon.SuccessResp(c, gin.H{\"token\": token})\n\tloginCache.Del(ip)\n}\n\nfunc ladpRegister(username string) (*model.User, error) {\n\tif username == \"\" {\n\t\treturn nil, errors.New(\"cannot get username from ldap provider\")\n\t}\n\tuser := &model.User{\n\t\tID:         0,\n\t\tUsername:   username,\n\t\tPassword:   random.String(16),\n\t\tPermission: int32(setting.GetInt(conf.LdapDefaultPermission, 0)),\n\t\tBasePath:   setting.GetStr(conf.LdapDefaultDir),\n\t\tRole:       nil,\n\t\tDisabled:   false,\n\t}\n\tif err := db.CreateUser(user); err != nil {\n\t\treturn nil, err\n\t}\n\treturn user, nil\n}\n\nfunc dial(ldapServer string) (*ldap.Conn, error) {\n\tvar tlsEnabled bool = false","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/server/handles/ldap_login.go#L108-L144","documentation":"Returned by ladpRegister when the username extracted from the LDAP bind result is an empty string. During LDAP auto-registration the server maps the authenticated LDAP user to a local model.User; a usable username is mandatory because it becomes the local login identity, so an empty mapping aborts registration before db.CreateUser.","triggerScenarios":"Successful LDAP authentication where the configured username attribute is absent from the user entry or maps to an empty value (e.g. attribute 'uid' vs 'sAMAccountName' mismatch, or 'cn' empty).","commonSituations":"OpenLDAP deployments where accounts key on 'uid' but the setting points at 'cn' or 'mail'; AD trees where 'sAMAccountName' is fine but the filter matches computer objects with different attributes; LDAP user attribute mappings changed after a directory schema migration.","solutions":["Check the LDAP username-attribute setting and set it to an attribute every target user entry actually has (uid / sAMAccountName)","Inspect the user entry with ldapsearch using the same filter and base DN to confirm which attribute carries the login name","Pre-create the local user (or disable LDAP auto-register) until the attribute mapping is fixed"],"exampleFix":"// before: ldap settings\nusername_attribute: \"cn\"   # empty for some entries\n// after\nusername_attribute: \"uid\"","handlingStrategy":"validation","validationCode":"// Before enabling LDAP auto-register, verify the attribute exists for sample users\n// ldapsearch -x -H <url> -D <bind> -w <pw> -b <baseDN> <filter> <usernameAttribute>","typeGuard":null,"tryCatchPattern":"user, err := ladpRegister(username)\nif err != nil && strings.Contains(err.Error(), \"cannot get username from ldap provider\") {\n    // config issue: username attribute mapping is wrong or empty in the entry — fix LDAP settings\n}","preventionTips":["Validate the username attribute against real entries with ldapsearch before going live","Prefer 'uid' (OpenLDAP) or 'sAMAccountName' (AD) over 'cn' or 'mail'","Restrict the LDAP search filter to person objects so computer/shared entries cannot match"],"tags":["ldap","auth","auto-registration","config"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}