rancher/rancher · error

saml search get principals search error: %s

Error message

saml search get principals search error: %s

What it means

The LDAP search inside samlSearchGetPrincipal (used when a SAML provider delegates user/group lookup to LDAP) failed at the protocol level: the server returned an error for the whole-subtree search under the user or group search base. The wrapped %s text carries the directory error (operations error, size/time limit, unavailable, invalid syntax).

Source

Thrown at pkg/auth/providers/ldap/ldap_provider.go:381

			config.GetUserSearchAttributes(ObjectClass),
		)
	} else {
		filter := fmt.Sprintf(
			"(&(%s=%s)(%s=%s))",
			ObjectClass, ldap.SanitizeAttr(config.GroupObjectClass),
			config.GroupDNAttribute, ldapv3.EscapeFilter(externalID),
		)

		searchRequest = ldap.NewWholeSubtreeSearchRequest(
			config.GroupSearchBase,
			filter,
			config.GetGroupSearchAttributes(ObjectClass),
		)
	}

	result, err := lConn.Search(searchRequest)
	if err != nil {
		return nil, fmt.Errorf("saml search get principals search error: %s", err)
	}

	if len(result.Entries) < 1 {
		return nil, fmt.Errorf("no identities can be retrieved")
	} else if len(result.Entries) > 1 {
		return nil, fmt.Errorf("more than one result found")
	}

	entry := result.Entries[0]
	entryAttributes := entry.Attributes

	if scope == p.userScope {
		userLoginValues := ldap.GetAttributeValuesByName(entry.Attributes, config.UserLoginAttribute)
		if len(userLoginValues) > 0 {
			externalID = userLoginValues[0] // only support first
		}
	} else {
		groupDNValues := ldap.GetAttributeValuesByName(entry.Attributes, config.GroupDNAttribute)

View on GitHub (pinned to 932558d4e6)

Solutions

1. Read the wrapped error string - operationsError usually means bind/permissions, adminLimitExceeded means size/time limit
2. Run the equivalent ldapsearch as the service account against the same base and filter
3. Fix attribute names / search bases in the LDAP config or raise server-side limits
4. Verify the service account can read both UserSearchBase and GroupSearchBase

// Pre-flight the exact search the SAML path will run
res, err := conn.Search(ldap.NewWholeSubtreeSearchRequest(base, filter, attrs))
if err != nil {
    return fmt.Errorf("directory rejected search (permissions/limits?): %w", err)
}

if err != nil && strings.Contains(err.Error(), "saml search get principals search error") {
    // unwrap: operationsError => service-account rights; adminLimitExceeded => raise limits
    return diagnoseSearchFailure(err)
}

When it happens

Trigger: lConn.Search on the built filter fails: service account lacks rights on the search base, server-side size/time limits exceeded, filter syntax invalid for the directory (e.g. UserLoginAttribute containing characters needing escaping in the DN-attribute branch), or the directory is under load/unavailable.

Common situations: Service account permissions scoped only to a subtree while GroupSearchBase sits outside it; large directories exceeding the search limit; attribute names wrong for the schema (mail vs userPrincipalName).

Related errors

• no identities can be retrieved
• Unauthorized
• ldap user search found more than one result
• activedirectory: error binding service account: %w
• activedirectory: error searching for query %s: %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/a61a0c436f65fe29. Report an issue: GitHub.