theonedev/onedev · warning · UnknownAccountException

Unknown account

Error message

Unknown account

What it means

After searching every configured user search base with the user search filter, OneDev found no matching LDAP entries. It throws UnknownAccountException('Unknown account') to signal the login name does not correspond to any directory user visible under the configured bases and filter.

Source

Thrown at server-plugin/server-plugin-authenticator-ldap/src/main/java/io/onedev/server/plugin/authenticator/ldap/LdapAuthenticator.java:255

        try {
            logger.debug("Binding to ldap url '" + getLdapUrl() + "'...");
            try {
            	ctx = new InitialDirContext(ldapEnv);
            } catch (AuthenticationException e) {
        		throw new RuntimeException("Cannot bind to ldap server '" + getLdapUrl() + "': " + e.getMessage());
            }

			NamingEnumeration<SearchResult> results = null;
			for (var userSearchBase: getUserSearchBases()) {
				 results = ctx.search(new CompositeName().add(userSearchBase), 
						userSearchFilter, searchControls);
				 if (results.hasMore())
					 break;
			}
			if (results == null)
				throw new ExplicitException("No user search base specified");
			if (!results.hasMore())
				throw new UnknownAccountException("Unknown account");
            
            SearchResult searchResult = results.next();
            String userDN = searchResult.getNameInNamespace();
            if (!searchResult.isRelative()) {
            	StringBuilder builder = new StringBuilder();
                builder.append(StringUtils.substringBefore(searchResult.getName(), "//"));
                builder.append("//");
                builder.append(StringUtils.substringBefore(
                		StringUtils.substringAfter(searchResult.getName(), "//"), "/"));
                
                ldapEnv.put(Context.PROVIDER_URL, builder.toString());
                logger.debug("Binding to referral ldap url '" + builder.toString() + "'...");
                referralCtx = new InitialDirContext(ldapEnv);
            }
            if (userDN.startsWith("ldap")) {
            	userDN = StringUtils.substringAfter(userDN, "//");
            	userDN = StringUtils.substringAfter(userDN, "/");
            }

View on GitHub (pinned to d44925c47c)

Solutions

1. Verify the username with ldapsearch against the same base and filter, e.g. ldapsearch -H ldaps://host -D 'manager dn' -W -b 'ou=People,dc=example,dc=com' '(uid=jdoe)'.
2. Widen the user search base to the OU or domain root that actually contains the user.
3. Check the user search filter attribute matches your directory schema (use sAMAccountName for Active Directory, uid for OpenLDAP).
4. Confirm the manager DN binding has read access to the OU containing the user.

Example fix

// before (AD): userSearchFilter = "(uid={username})"
// after  (AD): userSearchFilter = "(sAMAccountName={username})"

// Pre-check with ldapsearch before blaming the app:
// ldapsearch -H ldaps://host -D '<manager dn>' -W -b '<search base>' '(uid=<user>)' dn

try {
    auth.authenticate(token);
} catch (UnknownAccountException e) {
    // distinguish 'user not in directory' from 'wrong password' for the user-facing message
}

When it happens

Trigger: ctx.search over all userSearchBases with userSearchFilter returns no entries for the entered username — either the user does not exist in the directory, or the search bases/filter exclude them.

Common situations: User exists in a different OU than the configured search base; userSearchFilter (e.g. '(uid={username})') uses an attribute that's empty in the directory (sAMAccountName vs uid); AD users in a domain not covered by the base; typo in username.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• No external password authenticator to authenticate user "{0}
• Unable to change password as you are authenticating via exte
• No user search base specified
• Incorrect credentials
• Authentication required

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/45e3de722b5a0910. Report an issue: GitHub.