Error "LDAP Query failed" or "No users found" during IAM User Search

Products

• Service Virtualization

Issue/Introduction

When attempting to search for users within the IAM (Keycloak) console with LDAP integration enabled, the following issues occur:

1. UI Error: "No users found, could be due to wrongly configured federated provider. For more on this error, consult the server log at the debug level."
2. Server Log Error:
    

   ERROR [org.keycloak.services.error.KeycloakErrorHandler] Uncaught server error: org.keycloak.models.ModelException: LDAP Query failedCaused by: javax.naming.NamingException: [LDAP: error code 1 - 000020D6: SvcErr: DSID-03100837, problem 5012 (DIR_ERROR), data 0]; remaining name 'cn={0}'

 

Environment

All supported DevTest Environments 

Cause

The issue is caused by an incorrect configuration of the LDAP Search Base DN. The system was configured using a specific user template (e.g., cn={0}) instead of a valid container.

 # WRONG CONFIGURATION
ldap.base.dn=cn={0}

LDAP search bases must point to a top-level domain component or an Organizational Unit (OU) container. Using a template string like cn={0} in the search base field causes the directory query to fail with a NamingException.

 

Resolution

Update the LDAP configuration to use a proper search base DN where the user objects reside.

1. Navigate to the IAM / Keycloak Admin Console.
2. Go to User Federation and select your LDAP provider.
3. Locate the Edit section for LDAP Settings.
4. Change the Search Base DN from the incorrect template to the actual OU path.

Example Correction:

• Wrong Configuration: ldap.base.dn=cn={0}
• Correct Configuration: ldap.base.dn=ou=Users,dc=yourdomain,dc=com

5. Save the settings and test the user search again. The IAM system should now be able to traverse the directory structure and retrieve user records successfully.