passbolt/passbolt_api · error · BadRequestException

The settings provided are incorrect.

Error message

The settings provided are incorrect. 

What it means

Thrown when LdapConfigurationForm::execute() throws during POST /directorysync/test — the payload passed validation but the live LDAP operation performed by the form execution failed. The exception message is prefixed 'The settings provided are incorrect. ' and returned as HTTP 400, with the original exception preserved as previous.

Solutions

1. Read the full message after the prefix and the chained exception in logs for the concrete LDAP failure.
2. Test connectivity from the passbolt host with ldapsearch (ldap://host:389 or ldaps://host:636).
3. Verify bind DN/password and base DN.
4. Trust the LDAP server's CA certificate for LDAPS (update ca-certificates / configure LDAPTLS_CACERT).
5. Re-run POST /directorysync/test after each fix; it does not save settings so it is safe to iterate.

Example fix

// before
"hosts": "ldaps://ldap.internal", "port": 636 (untrusted self-signed cert)
// 400 The settings provided are incorrect. Can't contact LDAP server
// after
# add CA cert then retry
export LDAPTLS_CACERT=/etc/ssl/ldap-ca.pem
# and ensure config uses reachable host/port
{"directory_type": "ldap", "hosts": "ldap.internal", "port": 636}

try {
    await api.post('/directorysync/test.json', payload);
} catch (e) {
    if (e.response?.status === 400 && String(e.response.data?.message || '').startsWith('The settings provided are incorrect.')) {
        const cause = e.response.data.message.replace('The settings provided are incorrect. ', '');
        // cause describes the LDAP connect/bind failure; fix host/port/credentials/TLS
    }
    throw e;
}

When it happens

Trigger: POST /directorysync/test where $form->execute($data) fails — e.g. cannot connect to the LDAP host, bind rejected, or the form's execute step hits an unexpected error against the real directory.

Common situations: Typo'd host/port; LDAP server unreachable from the passbolt server network; invalid bind credentials; LDAPS certificate not trusted; directory server rejecting anonymous bind.

Related errors

• Could not save the settings.
• 500
• A mapping rule for ID attribute could not be found for…
• A mapping rule for username attribute could not be found…
• An error has occurred parsing groupCustomFilter

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/a404454a3544a966. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/DirectorySync/src/Controller/DirectorySettingsController.php:122

     *
     * @return void
     */
    public function test()
    {
        if (!$this->User->isAdmin()) {
            throw new ForbiddenException(__('You are not authorized to access that location.'));
        }

        $data = $this->request->getData();
        $form = new LdapConfigurationForm();
        if (!$form->validate($data)) {
            $errors = $form->getErrors();
            throw new CustomValidationException('Could not validate settings.', $errors);
        }
        try {
            $form->execute($data);
        } catch (Exception $e) {
            throw new BadRequestException(
                'The settings provided are incorrect. ' . $e->getMessage(),
                null,
                $e
            );
        }

        try {
            $settings = LdapConfigurationForm::formatFormDataToOrgSettings($data);
            $orgSettings = new DirectoryOrgSettings($settings);
            $directory = DirectoryFactory::get($orgSettings);
            $filteredDirectoryResults = $directory->getFilteredDirectoryResults();
            $outputData = [
                'users' => $this->_toArray(array_values($filteredDirectoryResults->getUsers())),
                'groups' => $this->_toArray(array_values($filteredDirectoryResults->getGroups())),
            ];
        } catch (Exception $e) {
            throw new BadRequestException('The users and groups cannot be retrieved. ' . $e->getMessage());
        }

View on GitHub (pinned to 31c1bbc10f)