LDAP authentication fails due to incorrect group filter syntax
This article explains how incorrect group filter syntax in the LDAP configuration for Adobe Experience Manager can cause Active Directory authentication and group synchronization failures, and provides steps to resolve the issue.
Description description
Environment
Adobe Experience Manager (AEM)
Issue/Symptoms
- You are unable to log in via Active Directory (AD) LDAP authentication.
- AD group synchronization doesn’t occur as expected.
- Review of the LDAP configuration reveals incorrect group filter syntax, such as an unclosed outer parenthesis in the filter expression.
Cause
A malformed group filter (such as a missing closing parenthesis) in the LDAP configuration prevents proper group resolution and synchronization, resulting in authentication failures.
Resolution resolution
To fix the issue, follow these steps:
- Review the Group extra filter field in the LDAP configuration for AEM.
- Ensure that the filter expression is syntactically correct. For example, the filter should be:
(|(cn=AEM-QA-Authors)(cn=AEM-QA-Administrators))and not missing a closing parenthesis. - Save the updated configuration.
- Test login with an AD user and verify that group synchronization now works as expected.
- If issues persist, double-check the user filter and other LDAP settings for syntax errors.
recommendation-more-help
experience-cloud-kcs-help-kbarticles