passbolt/passbolt_api · warning

group(s) returned by your directory are invalid and will be…

Error message

{0} group(s) returned by your directory are invalid and will be ignored during synchronization

What it means

TestCommand::displayInvalidEntries warns that N groups returned by the directory failed entity validation and will be ignored during synchronization. Like the user variant, the directory was reachable but group entities didn't pass validation rules (e.g. empty group name from a bad name attribute mapping).

Solutions

1. Re-run with --verbose; note that group detail output follows the same pattern as users to inspect errors.
2. Fix the group name attribute mapping in directory sync configuration.
3. Clean up invalid groups in the directory or narrow the group search filter/base DN.
4. Validate the search filter returns only group objects (objectClass filter).

$invalidGroups = array_filter($groups, fn($g) => (bool)$g->getErrors());
if ($invalidGroups) { echo count($invalidGroups) . " invalid groups will be skipped\n"; }

foreach ($data['groups'] as $group) {
    if (!($group instanceof \Passbolt\DirectorySync\Model\Entity\DirectoryEntry)) { continue; }
    if ($group->getErrors()) { /* handle */ }
}

When it happens

Trigger: `bin/cake passbolt directory_sync test` where $directoryResults->getGroups() contains entities failing validation, typically groups with missing or malformed names/DNs.

Common situations: Group name attribute mapping wrong (e.g. mapped to cn vs dn incorrectly), security-principal search scope including non-group objects, groups with empty names, or name length/charset rule violations.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• users returned by your directory are invalid and will be…
• $exception->getMessage()
• $message
• $msg
• The record model is not valid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/8c26ea82853821c5. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/DirectorySync/src/Command/TestCommand.php:206

        if (count($data['users'])) {
            $io->hr();
            $io->err(
                __(
                    '{0} users returned by your directory are invalid and will be ignored during synchronization',
                    count($data['users'])
                )
            );
            $io->err(__('bin/cake directory_sync test --verbose for more details'));
            $io->hr();
            foreach ($data['users'] as $user) {
                $io->verbose(__('Error: ') . $user->getErrorsAsString());
                $io->verbose(json_encode($user->toArray(), JSON_PRETTY_PRINT));
            }
        }

        if (count($data['groups'])) {
            $io->hr();
            $io->err(
                __(
                    '{0} group(s) returned by your directory are invalid and will be ignored during synchronization',
                    count($data['groups'])
                )
            );
            $io->hr();
            foreach ($data['groups'] as $group) {
                $io->verbose(__('Error: ') . $group->getErrorsAsString());
                $io->verbose(json_encode($group->toArray(), JSON_PRETTY_PRINT));
            }
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)