feliwir•2mo ago

Unable to register LDAP user

When i succesfully login with an LDAP user i get a form that asks me to review the user (see attached image). When i press "Continue" it just states "Could not register user". The log contains no information apart from this:

zitadel-1  | time="2025-09-18T11:44:15Z" level=info msg=activity caller="/home/runner/work/zitadel/zitadel/internal/activity/activity.go:105" domain="https://auth.mray.app" grpcStatus=3 httpStatus=400 instance=334904200339128323 isSystemUser=false method=/zitadel.user.v2.UserService/AddHumanUser org=334904200339193859 path= requestMethod= trigger=resourceAPI user=334904200339783683

zitadel-1  | time="2025-09-18T11:44:15Z" level=info msg=activity caller="/home/runner/work/zitadel/zitadel/internal/activity/activity.go:105" domain="https://auth.mray.app" grpcStatus=3 httpStatus=400 instance=334904200339128323 isSystemUser=false method=/zitadel.user.v2.UserService/AddHumanUser org=334904200339193859 path= requestMethod= trigger=resourceAPI user=334904200339783683

27 Replies

feliwirOP•2mo ago

This is the LDAP configuration

feliwirOP•2mo ago

(It's a Microsoft AD running on Windows Server 2012) Hello? @Moderator Is this issue being looked at?

Rajat•2mo ago

hey @feliwir thanks for question, I am looking into it hey @feliwir may I know, which doc did you followed to setup LDAP?.

feliwirOP•2mo ago

@Rajat we did follow this guide: https://zitadel.com/docs/guides/integrate/identity-providers/openldap but we don't have an OpenLDAP

Rajat•2mo ago

I will take a look at it, we did not hear any potential LDAP issues. “Could not register user” means LDAP entry is missing required attributes (usually email). Map an attribute that actually exists, delete the broken user and see if you can log in again.

feliwirOP•2mo ago

the email is displayed in the blurred screenshot i pasted above though (correctly displayed)

Rajat•2mo ago

hey @feliwir good morning, I will try to reproduce this and get back to you

feliwirOP•2mo ago

@Rajat were you able to reproduce the issue?

Rajat•2mo ago

hey @feliwir I didn't but I found out I have tested it back in august, notice what I have written, I think you may have to check your setup again. I just checked my old setup(which works) . when you click on more after LDAP Attributes , do you have values populated(attached my screenshot)?

Rajat•2mo ago

can you also try running ldapsearch

ldapsearch -H <ldap/ldaps-url> -D "<bindDN>" -w '<pwd>' -b "<userBaseDN>" "(uid=<username>)" \
  uid cn givenName sn mail

ldapsearch -H <ldap/ldaps-url> -D "<bindDN>" -w '<pwd>' -b "<userBaseDN>" "(uid=<username>)" \
  uid cn givenName sn mail

feliwirOP•2mo ago

those are the only ones i've configured

feliwirOP•2mo ago

it was enough to fill the 3 fields atleast that does work

Rajat•2mo ago

wdym? Can u share the output? are those values populated? are those attributes returned with values matches the attribute mapping in ldap IDP?

feliwirOP•2mo ago

For me the entry looks like this:

# Stephan Vedder, Users, mes-testing.local
dn: CN=Stephan Vedder,CN=Users,DC=mes-testing,DC=local
cn: Stephan Vedder
sn: Vedder
givenName: Stephan
mail: vedder@mbits.info

# Stephan Vedder, Users, mes-testing.local
dn: CN=Stephan Vedder,CN=Users,DC=mes-testing,DC=local
cn: Stephan Vedder
sn: Vedder
givenName: Stephan
mail: vedder@mbits.info

The fully entry like this:

# Stephan Vedder, Users, mes-testing.local
dn: CN=Stephan Vedder,CN=Users,DC=mes-testing,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Stephan Vedder
sn: Vedder
givenName: Stephan
distinguishedName: CN=Stephan Vedder,CN=Users,DC=mes-testing,DC=local
instanceType: 4
whenCreated: 20191211164541.0Z
whenChanged: 20250918074110.0Z
displayName: Stephan Vedder
uSNCreated: 12830
memberOf: CN=G-Development,OU=mbits,DC=mes-testing,DC=local
uSNChanged: 446798
name: Stephan Vedder
objectGUID:: RbG8s668lk2K4fi4rDfiEw==
userAccountControl: 66048
badPwdCount: 3
codePage: 0
countryCode: 0
badPasswordTime: 134031931070711929
lastLogoff: 0
lastLogon: 134026548702995170
pwdLastSet: 133747631975527875
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAn6lypzOBdcpsQiXJVwQAAA==
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: Vedder
sAMAccountType: 805306368
userPrincipalName: vedder@mes-testing.local
lockoutTime: 0
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=mes-testing,DC=local
dSCorePropagationData: 20191211172228.0Z
dSCorePropagationData: 20191211172119.0Z
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 134026548702995170
mail: vedder@mbits.info

# Stephan Vedder, Users, mes-testing.local
dn: CN=Stephan Vedder,CN=Users,DC=mes-testing,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Stephan Vedder
sn: Vedder
givenName: Stephan
distinguishedName: CN=Stephan Vedder,CN=Users,DC=mes-testing,DC=local
instanceType: 4
whenCreated: 20191211164541.0Z
whenChanged: 20250918074110.0Z
displayName: Stephan Vedder
uSNCreated: 12830
memberOf: CN=G-Development,OU=mbits,DC=mes-testing,DC=local
uSNChanged: 446798
name: Stephan Vedder
objectGUID:: RbG8s668lk2K4fi4rDfiEw==
userAccountControl: 66048
badPwdCount: 3
codePage: 0
countryCode: 0
badPasswordTime: 134031931070711929
lastLogoff: 0
lastLogon: 134026548702995170
pwdLastSet: 133747631975527875
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAn6lypzOBdcpsQiXJVwQAAA==
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: Vedder
sAMAccountType: 805306368
userPrincipalName: vedder@mes-testing.local
lockoutTime: 0
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=mes-testing,DC=local
dSCorePropagationData: 20191211172228.0Z
dSCorePropagationData: 20191211172119.0Z
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 134026548702995170
mail: vedder@mbits.info

so "uid" does not exist @Rajat is the output useful to you?

Rajat Singh•2mo ago

Hey @feliwir good morning, I'll try to set it up Today and give you an update

Rajat•2mo ago

hey @feliwir I am going to reproduce the issue right now, I will follow along and see if I run into any issues and will update you on it.

Rajat•2mo ago

hey @feliwir I did made some progress but with different errors we have to open an issue anyways as we both are hititng 2 different errors, this was past enteruing username/password which was user01/bitnami1 for me from the doc

Rajat•2mo ago

ok i made some progress, still not redirecting, very close

Rajat•2mo ago

ok its working!

feliwirOP•2mo ago

woa, great Sorry i was out for lunch 😄 What was the issue? What did you need to change?

Rajat•2mo ago

I will attach my docker compose file and the ldif file that I have

Rajat•2mo ago

my ldap server

ldap-compose.yaml

Rajat•2mo ago

docker-compose.yaml

Rajat•2mo ago

my values on the ldap idp Servers: ldap://docker-compose-openldap-1:1389 BaseDn: dc=example,dc=com BindDn: cn=admin,dc=example,dc=com Bind PW: Password1! Userbase: dn User filters: uid User Object Classes: inetOrgPerson More (attributes): ID=uid, Display=cn, Email=mail, Given=givenName, Family=sn, Preferred username=uid can you also try

ldapsearch -H ldaps://<your-host>:636 -x \
  -D "CN=LDAP Reader,OU=Service Accounts,DC=mes-testing,DC=local" -W \
  -b "DC=mes-testing,DC=local" \
  "(sAMAccountName=Vedder)" sAMAccountName userPrincipalName givenName sn mail objectGUID

ldapsearch -H ldaps://<your-host>:636 -x \
  -D "CN=LDAP Reader,OU=Service Accounts,DC=mes-testing,DC=local" -W \
  -b "DC=mes-testing,DC=local" \
  "(sAMAccountName=Vedder)" sAMAccountName userPrincipalName givenName sn mail objectGUID

I dont see your email here, but check if there's a duplicate email(matches with the one blurred in this screenshot) until here, strartibg from my files shared , THIS setup works for me, I just did deploy(as you can see above) and it all works, I didnt hit any issues apart from could not start LDAP flow

feliwirOP•2mo ago

Hm, i wonder if this is related to being a Microsoft AD

# extended LDIF
#
# LDAPv3
# base <DC=mes-testing,DC=local> with scope subtree
# filter: (sAMAccountName=Vedder)
# requesting: sAMAccountName userPrincipalName givenName sn mail objectGUID 
#

# Stephan Vedder, Users, mes-testing.local
dn: CN=Stephan Vedder,CN=Users,DC=mes-testing,DC=local
sn: Vedder
givenName: Stephan
objectGUID:: RbG8s668lk2K4fi4rDfiEw==
sAMAccountName: Vedder
userPrincipalName: vedder@mes-testing.local
mail: vedder@mbits.info

# search reference
ref: ldap://ForestDnsZones.mes-testing.local/DC=ForestDnsZones,DC=mes-testing,
 DC=local

# search reference
ref: ldap://DomainDnsZones.mes-testing.local/DC=DomainDnsZones,DC=mes-testing,
 DC=local

# search reference
ref: ldap://mes-testing.local/CN=Configuration,DC=mes-testing,DC=local

# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

# extended LDIF
#
# LDAPv3
# base <DC=mes-testing,DC=local> with scope subtree
# filter: (sAMAccountName=Vedder)
# requesting: sAMAccountName userPrincipalName givenName sn mail objectGUID 
#

# Stephan Vedder, Users, mes-testing.local
dn: CN=Stephan Vedder,CN=Users,DC=mes-testing,DC=local
sn: Vedder
givenName: Stephan
objectGUID:: RbG8s668lk2K4fi4rDfiEw==
sAMAccountName: Vedder
userPrincipalName: vedder@mes-testing.local
mail: vedder@mbits.info

# search reference
ref: ldap://ForestDnsZones.mes-testing.local/DC=ForestDnsZones,DC=mes-testing,
 DC=local

# search reference
ref: ldap://DomainDnsZones.mes-testing.local/DC=DomainDnsZones,DC=mes-testing,
 DC=local

# search reference
ref: ldap://mes-testing.local/CN=Configuration,DC=mes-testing,DC=local

# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

I fixed it the error was that the checkbox for "Create user if not exists" wasn't set.... However there is a bug that the checkbox unchecks itself randomly

Gigi the Giraffe (Zitadel)•2mo ago

🎉 Looks like you just helped out another community member! Thanks for being so helpful <@279655433726066688>! You're now one step closer to leveling up—keep up the amazing peer support! 🚀

Rajat•2mo ago

hey @feliwir pls open an issue https://github.com/zitadel/zitadel/issues and I will inform the engineering team

Unable to register LDAP user

Did you find this page helpful?