LDAP group mapping #1057

Open
opened 2026-03-04 11:38:58 -05:00 by deekerman · 7 comments
Owner

Originally created by @valentintraen on GitHub (Feb 10, 2026).

Originally assigned to: @HocKu7 on GitHub.

Hi,
The ldap group mapping worked perfectly for me for a very long time but this is no longer the case now (I don't know since which version, I haven't had any new users to test...).
Do you see anything in my configuration that might no longer work?

It's annoying if updates break things like that :/

"authConfigurations": [ { "id": "ldap", "provider": "ldap", "displayName": "LDAP", "disabled": false, "iconURL": "", "description": "", "parameters": { "ldap-host": "[hidden]", "ldap-port": "389", "ldap-login": "sAMAccountName", "ldap-dn": "dc=interne,dc=[hidden],dc=com", "ldap-identifier-attr": "CN", "ldap-bind-user": "cn=[hidden],ou=services,dc=interne,dc=[hidden],dc=com", "ldap-bind-user-pwd": "[hidden]", "ldap-filter": "(CN=*)" } } ],

and :

Image
Originally created by @valentintraen on GitHub (Feb 10, 2026). Originally assigned to: @HocKu7 on GitHub. Hi, The ldap group mapping worked perfectly for me for a very long time but this is no longer the case now (I don't know since which version, I haven't had any new users to test...). Do you see anything in my configuration that might no longer work? It's annoying if updates break things like that :/ ` "authConfigurations": [ { "id": "ldap", "provider": "ldap", "displayName": "LDAP", "disabled": false, "iconURL": "", "description": "", "parameters": { "ldap-host": "[hidden]", "ldap-port": "389", "ldap-login": "sAMAccountName", "ldap-dn": "dc=interne,dc=[hidden],dc=com", "ldap-identifier-attr": "CN", "ldap-bind-user": "cn=[hidden],ou=services,dc=interne,dc=[hidden],dc=com", "ldap-bind-user-pwd": "[hidden]", "ldap-filter": "(CN=*)" } } ], ` and : <img width="1078" height="339" alt="Image" src="https://github.com/user-attachments/assets/45bb3bb5-c40d-4a08-a28e-77eb27b3988e" />
Author
Owner

@EvgeniaBzzz commented on GitHub (Feb 10, 2026):

@valentintraen could you, please, remind me what were the features in your ldap settings? memberOf?

Mapping for member is working for me now.

@EvgeniaBzzz commented on GitHub (Feb 10, 2026): @valentintraen could you, please, remind me what were the features in your ldap settings? `memberOf`? Mapping for `member` is working for me now.
Author
Owner

@valentintraen commented on GitHub (Feb 10, 2026):

Yes, memberOf.

I deployed cloudbeaver in production in version 25.2.0 or 25.2.1, and it sure worked for several subsequent versions.

@valentintraen commented on GitHub (Feb 10, 2026): Yes, memberOf. I deployed cloudbeaver in production in version 25.2.0 or 25.2.1, and it sure worked for several subsequent versions.
Author
Owner

@valentintraen commented on GitHub (Feb 10, 2026):

https://github.com/dbeaver/cloudbeaver/issues/2715#issuecomment-2931123554
From that date it worked for me

@valentintraen commented on GitHub (Feb 10, 2026): https://github.com/dbeaver/cloudbeaver/issues/2715#issuecomment-2931123554 From that date it worked for me
Author
Owner

@EvgeniaBzzz commented on GitHub (Feb 10, 2026):

memberOf is also working for me.

Please provide us with some extra information:

  • LDAP server version (Active Directory, OpenLDAP, or something else)
  • Logs of the user authentication process for the user who is not being mapped
  • Is the memberOf attribute definitely being used?
  • Full DN of the user who is not being mapped (it can be masked, the important thing is that the structure is clear), and full DN of the group
  • Results of ldapsearch queries showing that this user is definitely a member of the group
@EvgeniaBzzz commented on GitHub (Feb 10, 2026): `memberOf` is also working for me. Please provide us with some extra information: - LDAP server version (Active Directory, OpenLDAP, or something else) - Logs of the user authentication process for the user who is not being mapped - Is the `memberOf` attribute definitely being used? - Full DN of the user who is not being mapped (it can be masked, the important thing is that the structure is clear), and full DN of the group - Results of `ldapsearch` queries showing that this user is definitely a member of the group
Author
Owner

@valentintraen commented on GitHub (Feb 12, 2026):

  • LDAP server version (Active Directory, OpenLDAP, or something else) -> Active Directory

  • Logs of the user authentication process for the user who is not being mapped ->

12-02-2026 13:50:31.081 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > authLogout [bob.eponge, session: f10f46a0-1285-49d0-951c-a785614be75a]
12-02-2026 13:50:31.083 [qtp1058708051-161] WARN  o.j.d.registry.DataSourceRegistry - Some data source listeners are still registered: io.cloudbeaver.WebDataSourceConnectEventListener:io.cloudbeaver.WebDataSourceConnectEventListener@c4c71b9
12-02-2026 13:50:31.083 [qtp1058708051-161] WARN  o.j.d.registry.DataSourceRegistry - Some data source listeners are still registered: io.cloudbeaver.WebDataSourceConnectEventListener:io.cloudbeaver.WebDataSourceConnectEventListener@c4c71b9,io.cloudbeaver.WebGlobalProjectRegistryProxy$WebDBPEventListenerProxy:io.cloudbeaver.WebGlobalProjectRegistryProxy$WebDBPEventListenerProxy@473293b0
12-02-2026 13:50:31.130 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > activeUser [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a]
12-02-2026 13:50:31.217 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > openSession [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a]
12-02-2026 13:50:31.250 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > activeUser [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a]
12-02-2026 13:50:31.279 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getServerConfig [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a]
12-02-2026 13:50:31.309 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getSessionPermissions [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a]
12-02-2026 13:50:31.325 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getAuthProviders [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a]
12-02-2026 13:50:32.761 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > authLogin [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a]
12-02-2026 13:50:32.768 [qtp1058708051-153] DEBUG i.c.s.ldap.auth.LdapAuthProvider - Can't extract 'null' from ldap attributes
12-02-2026 13:50:32.772 [qtp1058708051-153] DEBUG i.c.s.ldap.auth.LdapAuthProvider - **Found 1 groups by memberOf attribute**
12-02-2026 13:50:32.773 [qtp1058708051-153] ERROR i.c.s.ldap.auth.LdapAuthProvider - Group not found
javax.naming.PartialResultException: Unprocessed Continuation Reference(s)
        at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3023)
        at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2997)
        at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.getNextBatch(AbstractLdapNamingEnumeration.java:148)
        at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMoreImpl(AbstractLdapNamingEnumeration.java:217)
        at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMore(AbstractLdapNamingEnumeration.java:189)
        at io.cloudbeaver.service.ldap.auth.LdapAuthProvider.findGroupsByMemberAttribute(LdapAuthProvider.java:613)
        at io.cloudbeaver.service.ldap.auth.LdapAuthProvider.getGroupForMember(LdapAuthProvider.java:555)
        at io.cloudbeaver.service.ldap.auth.LdapAuthProvider.detectAutoAssignmentTeam(LdapAuthProvider.java:514)
        at io.cloudbeaver.service.ldap.auth.LdapAuthProvider.detectAutoAssignments(LdapAuthProvider.java:106)
        at io.cloudbeaver.service.security.CBEmbeddedSecurityController.getAutoAssignUserData(CBEmbeddedSecurityController.java:2716)
        at io.cloudbeaver.service.security.CBEmbeddedSecurityController.finishAuthentication(CBEmbeddedSecurityController.java:2542)
        at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1925)
        at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.initiateAuthentication(WebServiceAuthImpl.java:181)
        at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authLogin(WebServiceAuthImpl.java:78)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at io.cloudbeaver.service.WebServiceBindingBase$ServiceInvocationHandler.invoke(WebServiceBindingBase.java:212)
        at jdk.proxy8/jdk.proxy8.$Proxy14.authLogin(Unknown Source)
        at io.cloudbeaver.service.auth.WebServiceBindingAuth.lambda$0(WebServiceBindingAuth.java:39)
        at graphql.execution.ExecutionStrategy.invokeDataFetcher(ExecutionStrategy.java:533)
        at graphql.execution.ExecutionStrategy.fetchField(ExecutionStrategy.java:497)
        at graphql.execution.ExecutionStrategy.fetchField(ExecutionStrategy.java:438)
        at graphql.execution.ExecutionStrategy.resolveFieldWithInfo(ExecutionStrategy.java:397)
        at graphql.execution.ExecutionStrategy.getAsyncFieldValueInfo(ExecutionStrategy.java:335)
        at graphql.execution.AsyncExecutionStrategy.execute(AsyncExecutionStrategy.java:57)
        at graphql.execution.Execution.executeOperation(Execution.java:180)
        at graphql.execution.Execution.execute(Execution.java:116)
        at graphql.GraphQL.execute(GraphQL.java:546)
        at graphql.GraphQL.lambda$parseValidateAndExecute$13(GraphQL.java:476)
        at java.base/java.util.concurrent.CompletableFuture.uniComposeStage(CompletableFuture.java:1187)
        at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:2341)
        at graphql.GraphQL.parseValidateAndExecute(GraphQL.java:471)
        at graphql.GraphQL.lambda$executeAsync$9(GraphQL.java:429)
        at java.base/java.util.concurrent.CompletableFuture.uniComposeStage(CompletableFuture.java:1187)
        at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:2341)
        at graphql.GraphQL.executeAsync(GraphQL.java:418)
        at graphql.GraphQL.execute(GraphQL.java:359)
        at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeQuery(GraphQLEndpoint.java:257)
        at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeSingleQuery(GraphQLEndpoint.java:195)
        at io.cloudbeaver.server.graphql.GraphQLEndpoint.doPost(GraphQLEndpoint.java:178)
        at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:653)
        at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:723)
        at org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:736)
        at org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1614)
        at io.cloudbeaver.server.jetty.RequestHostFilter.doFilter(RequestHostFilter.java:96)
        at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
        at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1586)
        at org.eclipse.jetty.ee10.websocket.servlet.WebSocketUpgradeFilter.doFilter(WebSocketUpgradeFilter.java:195)
        at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
        at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1586)
        at org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1547)
        at org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:819)
        at org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:436)
        at org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:464)
        at org.eclipse.jetty.ee10.servlet.SessionHandler.handle(SessionHandler.java:717)
        at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1060)
        at org.eclipse.jetty.server.Server.handle(Server.java:182)
        at org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:662)
        at org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:418)
        at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:322)
        at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:99)
        at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:478)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:441)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:293)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:201)
        at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:311)
        at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:979)
        at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1209)
        at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1164)
        at java.base/java.lang.Thread.run(Thread.java:1583)
12-02-2026 13:50:32.775 [qtp1058708051-153] DEBUG i.c.model.session.WebUserContext - refresh permissions bob.eponge 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c
12-02-2026 13:50:32.776 [qtp1058708051-153] DEBUG i.c.model.session.WebUserContext - refresh permissions bob.eponge 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c
12-02-2026 13:50:32.822 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > activeUser [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.232 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.232 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeParents [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.489 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > openSession [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.677 [qtp1058708051-180] DEBUG i.c.service.WebServiceBindingBase - API > activeUser [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.703 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getServerConfig [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.709 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getSessionPermissions [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.810 [qtp1058708051-180] DEBUG i.c.service.WebServiceBindingBase - API > getProjects [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.893 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getUserConnections [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.912 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.912 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.913 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.913 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.994 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.994 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.997 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:33.997 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:34.007 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:34.008 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:34.117 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:34.117 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:34.121 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
12-02-2026 13:50:34.121 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c]
  • Is the memberOf attribute definitely being used? -> yes (in logs : Found 1 groups by memberOf attribute)

  • Full DN of the user who is not being mapped (it can be masked, the important thing is that the structure is clear), and full DN of the group ->

user : CN=bob eponge,OU=SpecUser,OU=Utilisateurs,DC=interne,DC=[hidden],DC=com
group : CN=GS-Developpeur,CN=Users,DC=interne,DC=[hidden],DC=com
  • Results of ldapsearch queries showing that this user is definitely a member of the group_ ->
ldapsearch -x -h [hidden] -D "CN=[hidden],OU=services,DC=interne,DC=[hidden],DC=com" -w "[hidden]" -b "ou=Utilisateurs,dc=interne,dc=[hidden],dc=com" "(sAMAccountName=bob.eponge)" memberOf
# extended LDIF
#
# LDAPv3
# base <ou=Utilisateurs,dc=interne,dc=[hidden],dc=com> with scope subtree
# filter: (sAMAccountName=bob.eponge)
# requesting: memberOf 
#

# bob eponge, SpecUser, Utilisateurs, interne.[hidden].com
dn: CN=bob eponge,OU=SpecUser,OU=Utilisateurs,DC=interne,DC=[hidden],DC=co
 m
memberOf: CN=GS-Developpeur,CN=Users,DC=interne,DC=[hidden],DC=com

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

This is a user with whom it worked perfectly before.

@valentintraen commented on GitHub (Feb 12, 2026): - LDAP server version (Active Directory, OpenLDAP, or something else) -> Active Directory - Logs of the user authentication process for the user who is not being mapped -> ``` 12-02-2026 13:50:31.081 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > authLogout [bob.eponge, session: f10f46a0-1285-49d0-951c-a785614be75a] 12-02-2026 13:50:31.083 [qtp1058708051-161] WARN o.j.d.registry.DataSourceRegistry - Some data source listeners are still registered: io.cloudbeaver.WebDataSourceConnectEventListener:io.cloudbeaver.WebDataSourceConnectEventListener@c4c71b9 12-02-2026 13:50:31.083 [qtp1058708051-161] WARN o.j.d.registry.DataSourceRegistry - Some data source listeners are still registered: io.cloudbeaver.WebDataSourceConnectEventListener:io.cloudbeaver.WebDataSourceConnectEventListener@c4c71b9,io.cloudbeaver.WebGlobalProjectRegistryProxy$WebDBPEventListenerProxy:io.cloudbeaver.WebGlobalProjectRegistryProxy$WebDBPEventListenerProxy@473293b0 12-02-2026 13:50:31.130 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > activeUser [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a] 12-02-2026 13:50:31.217 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > openSession [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a] 12-02-2026 13:50:31.250 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > activeUser [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a] 12-02-2026 13:50:31.279 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getServerConfig [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a] 12-02-2026 13:50:31.309 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getSessionPermissions [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a] 12-02-2026 13:50:31.325 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getAuthProviders [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a] 12-02-2026 13:50:32.761 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > authLogin [@unauthorized@, session: f10f46a0-1285-49d0-951c-a785614be75a] 12-02-2026 13:50:32.768 [qtp1058708051-153] DEBUG i.c.s.ldap.auth.LdapAuthProvider - Can't extract 'null' from ldap attributes 12-02-2026 13:50:32.772 [qtp1058708051-153] DEBUG i.c.s.ldap.auth.LdapAuthProvider - **Found 1 groups by memberOf attribute** 12-02-2026 13:50:32.773 [qtp1058708051-153] ERROR i.c.s.ldap.auth.LdapAuthProvider - Group not found javax.naming.PartialResultException: Unprocessed Continuation Reference(s) at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3023) at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2997) at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.getNextBatch(AbstractLdapNamingEnumeration.java:148) at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMoreImpl(AbstractLdapNamingEnumeration.java:217) at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMore(AbstractLdapNamingEnumeration.java:189) at io.cloudbeaver.service.ldap.auth.LdapAuthProvider.findGroupsByMemberAttribute(LdapAuthProvider.java:613) at io.cloudbeaver.service.ldap.auth.LdapAuthProvider.getGroupForMember(LdapAuthProvider.java:555) at io.cloudbeaver.service.ldap.auth.LdapAuthProvider.detectAutoAssignmentTeam(LdapAuthProvider.java:514) at io.cloudbeaver.service.ldap.auth.LdapAuthProvider.detectAutoAssignments(LdapAuthProvider.java:106) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.getAutoAssignUserData(CBEmbeddedSecurityController.java:2716) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.finishAuthentication(CBEmbeddedSecurityController.java:2542) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1925) at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.initiateAuthentication(WebServiceAuthImpl.java:181) at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authLogin(WebServiceAuthImpl.java:78) at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) at java.base/java.lang.reflect.Method.invoke(Method.java:580) at io.cloudbeaver.service.WebServiceBindingBase$ServiceInvocationHandler.invoke(WebServiceBindingBase.java:212) at jdk.proxy8/jdk.proxy8.$Proxy14.authLogin(Unknown Source) at io.cloudbeaver.service.auth.WebServiceBindingAuth.lambda$0(WebServiceBindingAuth.java:39) at graphql.execution.ExecutionStrategy.invokeDataFetcher(ExecutionStrategy.java:533) at graphql.execution.ExecutionStrategy.fetchField(ExecutionStrategy.java:497) at graphql.execution.ExecutionStrategy.fetchField(ExecutionStrategy.java:438) at graphql.execution.ExecutionStrategy.resolveFieldWithInfo(ExecutionStrategy.java:397) at graphql.execution.ExecutionStrategy.getAsyncFieldValueInfo(ExecutionStrategy.java:335) at graphql.execution.AsyncExecutionStrategy.execute(AsyncExecutionStrategy.java:57) at graphql.execution.Execution.executeOperation(Execution.java:180) at graphql.execution.Execution.execute(Execution.java:116) at graphql.GraphQL.execute(GraphQL.java:546) at graphql.GraphQL.lambda$parseValidateAndExecute$13(GraphQL.java:476) at java.base/java.util.concurrent.CompletableFuture.uniComposeStage(CompletableFuture.java:1187) at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:2341) at graphql.GraphQL.parseValidateAndExecute(GraphQL.java:471) at graphql.GraphQL.lambda$executeAsync$9(GraphQL.java:429) at java.base/java.util.concurrent.CompletableFuture.uniComposeStage(CompletableFuture.java:1187) at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:2341) at graphql.GraphQL.executeAsync(GraphQL.java:418) at graphql.GraphQL.execute(GraphQL.java:359) at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeQuery(GraphQLEndpoint.java:257) at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeSingleQuery(GraphQLEndpoint.java:195) at io.cloudbeaver.server.graphql.GraphQLEndpoint.doPost(GraphQLEndpoint.java:178) at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:653) at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:723) at org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:736) at org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1614) at io.cloudbeaver.server.jetty.RequestHostFilter.doFilter(RequestHostFilter.java:96) at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205) at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1586) at org.eclipse.jetty.ee10.websocket.servlet.WebSocketUpgradeFilter.doFilter(WebSocketUpgradeFilter.java:195) at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205) at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1586) at org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1547) at org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:819) at org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:436) at org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:464) at org.eclipse.jetty.ee10.servlet.SessionHandler.handle(SessionHandler.java:717) at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1060) at org.eclipse.jetty.server.Server.handle(Server.java:182) at org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:662) at org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:418) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:322) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:99) at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:478) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:441) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:293) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:201) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:311) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:979) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1209) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1164) at java.base/java.lang.Thread.run(Thread.java:1583) 12-02-2026 13:50:32.775 [qtp1058708051-153] DEBUG i.c.model.session.WebUserContext - refresh permissions bob.eponge 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c 12-02-2026 13:50:32.776 [qtp1058708051-153] DEBUG i.c.model.session.WebUserContext - refresh permissions bob.eponge 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c 12-02-2026 13:50:32.822 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > activeUser [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.232 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.232 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeParents [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.489 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > openSession [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.677 [qtp1058708051-180] DEBUG i.c.service.WebServiceBindingBase - API > activeUser [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.703 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getServerConfig [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.709 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getSessionPermissions [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.810 [qtp1058708051-180] DEBUG i.c.service.WebServiceBindingBase - API > getProjects [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.893 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getUserConnections [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.912 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.912 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.913 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.913 [qtp1058708051-190] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.994 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.994 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.997 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:33.997 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:34.007 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:34.008 [qtp1058708051-153] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:34.117 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:34.117 [qtp1058708051-161] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:34.121 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeChildren [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] 12-02-2026 13:50:34.121 [qtp1058708051-208] DEBUG i.c.service.WebServiceBindingBase - API > getNavigatorNodeInfo [bob.eponge, session: 1aaa83a7-ef71-4da9-87ea-d8b476c02d9c] ``` - Is the memberOf attribute definitely being used? -> yes (in logs : Found 1 groups by memberOf attribute) - Full DN of the user who is not being mapped (it can be masked, the important thing is that the structure is clear), and full DN of the group -> ``` user : CN=bob eponge,OU=SpecUser,OU=Utilisateurs,DC=interne,DC=[hidden],DC=com group : CN=GS-Developpeur,CN=Users,DC=interne,DC=[hidden],DC=com ``` - Results of ldapsearch queries showing that this user is definitely a member of the group_ -> ``` ldapsearch -x -h [hidden] -D "CN=[hidden],OU=services,DC=interne,DC=[hidden],DC=com" -w "[hidden]" -b "ou=Utilisateurs,dc=interne,dc=[hidden],dc=com" "(sAMAccountName=bob.eponge)" memberOf # extended LDIF # # LDAPv3 # base <ou=Utilisateurs,dc=interne,dc=[hidden],dc=com> with scope subtree # filter: (sAMAccountName=bob.eponge) # requesting: memberOf # # bob eponge, SpecUser, Utilisateurs, interne.[hidden].com dn: CN=bob eponge,OU=SpecUser,OU=Utilisateurs,DC=interne,DC=[hidden],DC=co m memberOf: CN=GS-Developpeur,CN=Users,DC=interne,DC=[hidden],DC=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ``` This is a user with whom it worked perfectly before.
Author
Owner

@HocKu7 commented on GitHub (Feb 12, 2026):

@valentintraen could you please try to connect to Global Catalog and try again? Usually it has 3268 port for AD

@HocKu7 commented on GitHub (Feb 12, 2026): @valentintraen could you please try to connect to Global Catalog and try again? Usually it has 3268 port for AD
Author
Owner

@valentintraen commented on GitHub (Feb 17, 2026):

Good morning,
For security reasons, this port is not open to our servers and cannot be opened.
I don't understand the purpose of all these tests since it worked perfectly before :/

@valentintraen commented on GitHub (Feb 17, 2026): Good morning, For security reasons, this port is not open to our servers and cannot be opened. I don't understand the purpose of all these tests since it worked perfectly before :/
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/cloudbeaver#1057
No description provided.