passbolt/passbolt_api · error · RuntimeException

Mapping rules could not be found for directory type

Error message

Mapping rules could not be found for directory type: {0}

What it means

While populating the group collection from LDAP results, _populateGroups fetches the mapping rules for the group's directoryType. If no mapping rules exist for that directory type, GroupEntry::fromLdapObject could not be built, so a RuntimeException naming the directoryType is thrown during initializeWithLdapResults.

Solutions

  1. Re-save directory sync settings to regenerate mapping rules covering the group's directoryType
  2. Inspect the LDAP group entry's directoryType attribute and correct directory configuration so it matches a supported type
  3. Ensure only entries from the configured directory are returned by narrowing the LDAP group filter/base DN
  4. Add an explicit mapping-rules entry for the reported directoryType in the directory settings

Example fix

// before
$mappingRules = $this->mappingRules[$ldapGroup->getFirstAttribute('directoryType')] ?? null;
if (!$mappingRules) {
    throw new RuntimeException(
        __('Mapping rules could not be found for directory type: {0}', $directoryType)
    );
}
// after
$mappingRules = $this->mappingRules[$ldapGroup->getFirstAttribute('directoryType')] ?? null;
if (!$mappingRules) {
    Log::warning('Skipping group with unknown directoryType: ' . $directoryType);
    continue;
}
Defensive patterns

Strategy: try-catch

Validate before calling

foreach ($ldapGroups as $g) {
    $dt = $g->getFirstAttribute('directoryType');
    if (!isset($mappingRules[$dt])) { /* filter out or warn before processing */ }
}

Try / catch

try {
    $results->initializeWithLdapResults($ldapUsers, $ldapGroups);
} catch (RuntimeException $e) {
    if (str_contains($e->getMessage(), 'Mapping rules could not be found')) {
        // re-save directory settings, then retry the sync
    }
}

Prevention

When it happens

Trigger: initializeWithLdapResults encounters an LDAP group whose directoryType key is absent from $this->mappingRules (e.g. directoryType attribute value not one of 'ad'/'openldap' variants covered by settings).

Common situations: LDAP server returning an unusual or empty directoryType attribute; mixing entries from multiple directories (AD + OpenLDAP) while settings only define one directory's mappings; stale settings after upgrading the plugin.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/b569ede22a541265. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/DirectorySync/src/Utility/DirectoryEntry/DirectoryResults.php:302

        return $ldapObject;
    }

    /**
     * Populate groups list from Ldap results.
     *
     * @return void
     * @throws \Exception
     */
    private function _populateGroups(): void
    {
        /** @var \LdapRecord\Models\Entry $ldapGroup */
        foreach ($this->ldapGroups as $ldapGroup) {
            if (!isset($this->groups[$ldapGroup->getDn()])) {
                /** @var string $directoryType */
                $directoryType = $ldapGroup->getFirstAttribute('directoryType');
                $mappingRules = $this->mappingRules[$ldapGroup->getFirstAttribute('directoryType')] ?? null;
                if (!$mappingRules) {
                    throw new RuntimeException(
                        __('Mapping rules could not be found for directory type: {0}', $directoryType)
                    );
                }
                $groupEntry = GroupEntry::fromLdapObject($ldapGroup, $mappingRules);
                if (!empty($ldapGroup->getDn())) {
                    $this->groups[$ldapGroup->getDn()] = $groupEntry;
                } else {
                    $this->invalidGroups[] = $groupEntry;
                }
            }
        }
    }

    /**
     * Get invalid groups.
     * Invalid groups are groups that do not match the expected format and that will be ignored.
     *
     * @return array

View on GitHub (pinned to 31c1bbc10f)