How to Fix InvalidSearchFilterException When Syncing LDAP in Jira
Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
When synchronising the LDAP directory, the synchronisation fails with this in logs:
The following appears in the atlassian-jira.log:
2012-01-17 13:18:48,791 ERROR [QuartzScheduler_Worker-9] [atlassian.crowd.directory.DbCachingDirectoryPoller] pollChanges Error occurred while refreshing the cache for directory [ 10000 ].
com.atlassian.crowd.exception.OperationFailedException: java.util.concurrent.ExecutionException: com.atlassian.crowd.exception.OperationFailedException: org.springframework.ldap.InvalidSearchFilterException: Empty filter; nested exception is javax.naming.directory.InvalidSearchFilterException: Empty filter; remaining name 'DC=pirates,DC=oceans,DC=com'
at com.atlassian.crowd.directory.ldap.cache.UsnChangedCacheRefresher.synchroniseAllGroups(UsnChangedCacheRefresher.java:284)
at com.atlassian.crowd.directory.ldap.cache.AbstractCacheRefresher.synchroniseAll(AbstractCacheRefresher.java:41)Solution
Cause
One of the following fields is blank:
User Object Filter
Group Object Filter
Roles are enabled. This has been deprecated for quite some time and should always be disabled.
Next Step(s)
For Cause 1
Edit the LDAP directory configuration and populate the offending field as necessary, as described in our Connecting to an LDAP Directory documentation.
For Cause 2
Create a new LDAP directory. By default, the ldap.roles.disabled will be set to true
Otherwise, disable Roles in your current LDAP configuration. As there is no way to do this in the interface, this will require manual database edits. Here is the SQL query to return that attribute's information:
Always back up your data before performing any modifications to the database. If possible, test any alter, insert, update, or delete SQL commands on a staging server first.
Confirm the attribute_value is false with the below SQL:
select * from cwd_directory_attribute where attribute_name = 'ldap.roles.disabled';If it is false, backup JIRA.
Stop JIRA.
Execute the update statement below:
update cwd_directory_attribute set attribute_value = 'true' where attribute_name = 'ldap.roles.disabled';ℹ️ This SQL is for PostgreSQL and may require changing depending on your DBMS.
Start JIRA.
ℹ️ Please see our Troubleshooting LDAP User Management documentation for further assistance with diagnosing LDAP problems.
Was this helpful?