passbolt/passbolt_api · error · InvalidArgumentException

Using callbacks for groupCustomFilter is not supported…

Error message

Using callbacks for groupCustomFilter is not supported anymore. Please use LDAP search filter instead.

What it means

Same deprecation as for users but for groups: DirectorySync no longer supports callable groupCustomFilter. _customizeGroupsQuery throws this InvalidArgumentException when the stored group filter setting is a callable, requiring an LDAP search filter string instead.

Solutions

Replace the callable groupCustomFilter with an LDAP filter string such as '(objectClass=group)'
Delete the callback-based filter definition from the directory settings/configuration code
Re-run group sync and verify the expected groups are still matched

Example fix

// before
$settings->setGroupCustomFilters(function (Builder $query) { $query->where(['GroupType' => 'Security']); });
// after
$settings->setGroupCustomFilters('(groupType=-2147483646)');

Defensive patterns

Strategy: validation

Validate before calling

$filter = $this->directorySettings->getGroupCustomFilters();
if (is_callable($filter)) {
    throw new RuntimeException('groupCustomFilter must be an LDAP filter string, not a callback');
}

Type guard

$filter = is_string($customFilter) ? $customFilter : null;

Prevention

Use string LDAP filters for group selection
Review legacy group filter code after upgrades
Test group sync in staging with the new filter

When it happens

Trigger: Calling _fetchAndInitializeGroupsQuery (group LDAP lookup) when directorySettings->getGroupCustomFilters() returns a callable.

Common situations: Legacy integrations that filtered AD/LDAP groups via a PHP callback; code left over from an older passbolt version after an upgrade.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/ae42eacd470adddc. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/DirectorySync/src/Utility/LdapDirectory.php:581

            }
        }

        return $query;
    }

    /**
     * Customize groups query as per configuration (if available).
     *
     * @param \LdapRecord\Query\Builder $query query
     * @return \LdapRecord\Query\Builder
     * @throws \InvalidArgumentException If groupCustomFilter callback is used.
     * @throws \InvalidArgumentException If groupCustomFilter cannot be parsed.
     */
    private function _customizeGroupsQuery(Builder $query): Builder
    {
        $groupCustomFilter = $this->directorySettings->getGroupCustomFilters();
        if (is_callable($groupCustomFilter)) {
            throw new InvalidArgumentException(
                'Using callbacks for groupCustomFilter is not supported anymore. Please use LDAP search filter instead.'
            );
        } elseif (is_string($groupCustomFilter)) {
            try {
                $filter = Parser::parse($groupCustomFilter);
                $query->rawFilter(Parser::assemble($filter));
            } catch (ParserException $pe) {
                throw new InvalidArgumentException(
                    'An error has occurred parsing groupCustomFilter: ' . $pe->getMessage()
                );
            }
        }

        return $query;
    }

    /**
     * Return filters used to retrieve users as a string, in ldapsearch format.

View on GitHub (pinned to 31c1bbc10f)