LDAP Synchronization Fails with "Duplicate email found"

Problem

LDAP synchronization fails with an error similar to the following:

java.lang.IllegalStateException: Duplicate email found: user@example.com

Although the reported user may not appear in the IDE Services user list or belong to one of the LDAP groups intended for synchronization, the LDAP synchronization process stops during the validation stage and no users are imported.

Cause

This is expected behaviour.

During LDAP synchronization, IDE Services retrieves all directory entries that match the configured user-object-filter under the configured base-dn.

Each user returned by the LDAP query must have a unique email address. IDE Services uses the configured user-email-attribute as the user's identity key during the synchronization process.

If two or more LDAP entries returned by the user-object-filter contain the same email address, the synchronization is aborted and the following error is reported:

Duplicate email found: user@example.com

This commonly occurs in environments where:

• Standard and administrator accounts exist for the same user.
• Multiple LDAP accounts intentionally share the same email address.
• Duplicate LDAP objects are returned by the configured user-object-filter.

Note: Group mappings (mapping.groups and mapping.admin-groups) are applied after users have been retrieved from LDAP. They cannot be used to prevent duplicate email addresses from being detected during the initial validation phase.

Resolution

Review the configured user-object-filter and ensure that it only returns the LDAP users that should be synchronized into IDE Services.

For example, instead of returning every user beneath the configured base-dn, the filter can be narrowed to only return users who belong to the required LDAP groups.

Example:

user-object-filter: '(&(objectCategory=Person)(sAMAccountName=*)(|(memberOf=CN=<Group1>,OU=<OU>,DC=<Domain>)(memberOf=CN=<Group2>,OU=<OU>,DC=<Domain>)))'

Note: The filter above is an example only. Replace the group distinguished names (DNs) with the appropriate values for your LDAP environment.

After updating the configuration:

1. Save the changes.
2. Restart IDE Services.
3. Run the LDAP synchronization again.

If duplicate email addresses are no longer returned by the LDAP query, the synchronization should complete successfully. At present, the recommended approach is to configure the user-object-filter so that only the required LDAP accounts are returned during synchronization.