LDAP synchronization fails due to invalid search filter containing negation element.
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Symptoms
The LDAP synchronization fails with the following message in the atlassian-confluence.log:
Test retrieve user : Failed
org.springframework.ldap.InvalidSearchFilterException: Filter (!) cannot be followed by more than one filters; nested exception is javax.naming.directory.InvalidSearchFilterException: Filter (!) cannot be followed by more than one filters; remaining name 'DC=production,DC=tvn,DC=com'
Cause
Due to restrictions of the LDAP protocol, filters containing 'not' or 'negation'('!') must have one and only one filter element. Example of an invalid filter:
(&(objectCategory=Group)(!(CN=confluence*)(!(CN=jira*))))
See more details about LDAP filters in this documentation.
.
Resolution
You can fix the issue by following the below approaches.
Remove one of the negation operators. e.g.
(&(objectCategory=Group)(!(CN=confluence*)))Or wrap all elements within the OR operator (
pipe symbol '|'). Example:(&(objectCategory=Group)(!(|(CN=confluence*)(CN=jira*))))