open-webui/open-webui · error · HTTPException

User record mismatch.

Error message

User record mismatch.

What it means

Raised (400) when the lowercased submitted username is not present in username_list — the list of values of the entry's username attribute (lowercased). The user was found by the earlier search filter, but the attribute values on the returned entry don't actually contain the typed username, e.g. because the search matched on a different attribute than the one used for this final comparison.

Source

Thrown at backend/open_webui/routers/auths.py:702

                    raise HTTPException(500, detail='Internal error occurred during LDAP user creation.')

            user = await Auths.authenticate_user_by_email(email, db=db)

            if user:
                if ENABLE_LDAP_GROUP_MANAGEMENT and user_groups:
                    try:
                        if ENABLE_LDAP_GROUP_CREATION:
                            await Groups.create_groups_by_group_names(user.id, user_groups, db=db)
                        await Groups.sync_groups_by_group_names(user.id, user_groups, db=db)
                        log.info(f'Successfully synced groups for user {user.id}: {user_groups}')
                    except Exception as e:
                        log.error(f'Failed to sync groups for user {user.id}: {e}')

                return await create_session_response(request, user, db, response, set_cookie=True, source='ldap')
            else:
                raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)
        else:
            raise HTTPException(400, 'User record mismatch.')
    except Exception as e:
        log.error(f'LDAP authentication error: {str(e)}')
        raise HTTPException(400, detail='LDAP authentication failed.')


############################
# SignIn
############################


@router.post('/signin', response_model=SessionUserResponse)
async def signin(
    request: Request,
    response: Response,
    form_data: SigninForm,
    db: AsyncSession = Depends(get_async_session),
):
    if not ENABLE_PASSWORD_AUTH:

View on GitHub (pinned to 01f4282f1f)

Solutions

1. Inspect the user's entry and compare attribute values with the typed login name: ldapsearch showing attribute_for_username values
2. Align ldap.server.search_filter and attribute_for_username so both refer to the same attribute the users type
3. Normalize directory data (trim/case) so lowercased comparison succeeds
4. Have users log in with the exact value stored in attribute_for_username

# assert the typed username appears in the entry's attribute values
vals = [str(v).lower() for v in ([entry[attr].value] if not isinstance(entry[attr].value, list) else entry[attr].value)]
assert form_user.lower() in vals, 'search_filter and attribute_for_username are inconsistent'

When it happens

Trigger: Search filter matches via a custom ldap.server.search_filter clause (e.g. on mail or employeeID) but attribute_for_username holds a different value; attribute_for_username is multi-valued and the typed name matches only one variant with different casing/spacing; directory data inconsistency between the indexed filter attribute and the stored attribute values.

Common situations: Configuring search_filter='(mail=*domain.com)' while users log in with a value not in the sAMAccountName/uid list; trailing spaces or case in directory values after a migration; attribute renamed in AD after a domain consolidation.

Related errors

• LDAP authentication is not enabled
• Failed to configure TLS for LDAP connection.
• User not found in the LDAP server
• User does not have a valid email address.
• WEBUI_SECRET_KEY_LENGTH must be a positive integer

AI-assisted analysis of open-webui/open-webui@01f4282f1f (2026-08-14). Data as JSON: /api/errors/9f2e37c9fd129680. Report an issue: GitHub.