From 6146a4869e07c934e7fa04ff425895e48e005374 Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Wed, 23 Sep 2026 16:30:58 +0800
Subject: [PATCH] fix: use clearer message for ldap auth failure (#39392)

* fix #34942

log: `user does not exist ...: not in LDAP database or invalid password`
---
 models/user/error.go                             | 11 ++++++++---
 services/auth/source/ldap/source_authenticate.go |  4 ++--
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/models/user/error.go b/models/user/error.go
index a0dc1f9172b..21d50ec8040 100644
--- a/models/user/error.go
+++ b/models/user/error.go
@@ -31,8 +31,9 @@ func (err ErrUserAlreadyExist) Unwrap() error {
 
 // ErrUserNotExist represents a "UserNotExist" kind of error.
 type ErrUserNotExist struct {
-	UID  int64
-	Name string
+	UID      int64
+	Name     string
+	ExtraMsg string
 }
 
 // IsErrUserNotExist checks if an error is a ErrUserNotExist.
@@ -42,7 +43,11 @@ func IsErrUserNotExist(err error) bool {
 }
 
 func (err ErrUserNotExist) Error() string {
-	return fmt.Sprintf("user does not exist [uid: %d, name: %s]", err.UID, err.Name)
+	ret := fmt.Sprintf("user does not exist [uid: %d, name: %s]", err.UID, err.Name)
+	if err.ExtraMsg != "" {
+		ret += ": " + err.ExtraMsg
+	}
+	return ret
 }
 
 // Unwrap unwraps this error as a ErrNotExist error
diff --git a/services/auth/source/ldap/source_authenticate.go b/services/auth/source/ldap/source_authenticate.go
index fe735d192f0..c20ba13803f 100644
--- a/services/auth/source/ldap/source_authenticate.go
+++ b/services/auth/source/ldap/source_authenticate.go
@@ -31,8 +31,8 @@ func (source *Source) Authenticate(ctx context.Context, user *user_model.User, u
 	}
 	sr := source.SearchEntry(loginName, password, source.AuthSource.Type == auth.DLDAP)
 	if sr == nil {
-		// User not in LDAP, do nothing
-		return nil, user_model.ErrUserNotExist{Name: loginName}
+		// User is not in LDAP database, or password is invalid (direct bind)
+		return nil, user_model.ErrUserNotExist{Name: loginName, ExtraMsg: "not in LDAP database or invalid password"}
 	}
 	// Fallback.
 	// FIXME: this fallback would cause problems when the "Username" attribute is not set and a user inputs their email.