opf/openproject · error · LdapAuthSource::Error

LDAP-Error: Could not authenticate at the LDAP-Server.

Error message

LDAP-Error: Could not authenticate at the LDAP-Server.

What it means

LdapAuthSource#test_connection binds to the LDAP server with the configured system account (account/account_password) via authenticate_dn. A failed bind — not a network failure — raises LdapAuthSource::Error with the ldap_error template wrapping the fixed ldap_auth_failed text. The server was reached; the DN/password pair was rejected or the account is locked.

Source

Thrown at app/models/ldap_auth_source.rb:184

                    attributes: search_attributes) do |entry|
      attrs = get_user_attributes_from_ldap_entry(entry)
      Rails.logger.debug { "DN found for #{login}: #{attrs[:dn]}" }
    end

    attrs
  rescue Net::LDAP::Error => e
    raise LdapAuthSource::Error, "LdapError: #{e.message}"
  end

  # Open and return a system connection
  def with_connection
    yield initialize_ldap_con(account, account_password)
  end

  # test the connection to the LDAP
  def test_connection
    unless authenticate_dn(account, account_password)
      raise LdapAuthSource::Error,
            I18n.t("ldap_auth_sources.ldap_error", error_message: I18n.t("ldap_auth_sources.ldap_auth_failed"))
    end
  rescue Net::LDAP::Error => e
    raise LdapAuthSource::Error,
          I18n.t("ldap_auth_sources.ldap_error", error_message: e.to_s)
  end

  def get_user_attributes_from_ldap_entry(entry)
    base_attributes = {
      dn: entry.dn,
      ldap_auth_source_id: id
    }

    base_attributes.merge mapped_attributes(entry)
  end

  def mapped_attributes(entry)
    %i[login firstname lastname mail admin].each_with_object({}) do |key, hash|

View on GitHub (pinned to d9742c43f3)

Solutions

1. Re-enter the exact Bind DN and account password in the LDAP auth source form and test again.
2. Verify the credentials independently: ldapsearch -x -H <host> -D '<bind dn>' -W.
3. Check server-side for a locked/expired bind account and unlock/extend it.

Example fix

# before
auth_source.test_connection

# after (distinguish bind failure from network failure)
begin
  auth_source.test_connection
rescue LdapAuthSource::Error => e
  raise e.message.include?(I18n.t('ldap_auth_sources.ldap_auth_failed')) ? 'Bind rejected: check DN/password' : e
end

begin
  ldap_auth_source.test_connection
rescue LdapAuthSource::Error => e
  raise BindFailed, 'check bind DN/password' if e.message.include?(I18n.t('ldap_auth_sources.ldap_auth_failed'))
  raise
end

When it happens

Trigger: Clicking 'Test connection' on an LDAP auth source whose Bind DN or account password is wrong, the bind account's password expired, or the account got locked out by repeated failed attempts.

Common situations: Password rotation on the service account not reflected in OpenProject; Bind DN typed with the wrong DN structure (missing DC components); Active Directory disabling the account; copy-paste artifacts like trailing spaces or smart quotes in the password.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid API token. Please check your credentials in the conf
• LDAP-Error: %{error_message}
• Jira API returned a 401 error. Your authentication token may
• #{name} is not writable but can be set through env vars or c
• AuthProvider with slug: "#{slug}" has not been found

AI-assisted analysis of opf/openproject@d9742c43f3 (2026-08-21). Data as JSON: /api/errors/810d0b323e1464e9. Report an issue: GitHub.