Troubleshooting
Problem
An OpenShift user is created only when an LDAP user is added to a team or logs in to the IBM Cloud Pak console. If the LDAP user is removed on the LDAP server, the LDAP group in the team is not updated.
Red Hat OpenShift groups and users are not created, and users cannot log in to the Cloud Pak console.
Red Hat OpenShift groups are not updated by any IAM process or thread. An OpenShift user or group is deleted only when it is removed from a team.
To resolve this issue, delete and re‑add the LDAP group to the team to recreate the Red Hat OpenShift group with current members, and manually delete the Red Hat OpenShift user. Use the command
oc delete user <user_id>.Symptom
-
Recreation steps example:
- User attempts to create a Common Services team and add an LDAP group to the teamLDAP group: cluster-admin-groupCommon Services team name: my‑cluster‑admin‑team- LDAP group contains users, but some users no longer exist on the LDAP server.- Common Services team is created, but the corresponding OpenShift group and users are not created in OCP.- Users cannot log in to the Cloud Pak.- The team is created, but when the LDAP group name is selected, the users are not loaded. - The following messages are logged in the auth‑idp pods:
{"name":"platform-identity-mgmt","hostname":"auth-idp-7b4646b8b5-r8dn5","pid":1,"level":50,"msg":"User-Mgmt:: Error: Bad request, LDAP group could not be found based on search criteria. Please refine your search and try again","time":"2023-04-19T10:39:08.705Z","v":0}
{"name":"platform-identity-mgmt","hostname":"auth-idp-7b4646b8b5-r8dn5","pid":1,"level":30,"msg":"User-Mgmt:: Exiting /fetchLdapUserDetailsWithNewClient with error","time":"2023-04-19T10:39:08.705Z","v":0}
{"name":"platform-identity-mgmt","hostname":"auth-idp-7b4646b8b5-r8dn5","pid":1,"level":50,"msg":"catch: error: OperationalError: Bad request, LDAP group could not be found based on search criteria. Please refine your search and try again\n at Object.errorHandler (/opt/ibm/identity-mgmt/util/identity-util.js:61:17)\n ... 13 lines matching cause stack trace ...\n at TCP.onStreamRead (node:internal/stream_base_commons:190:23) {\n cause: Error: Bad request, LDAP group could not be found based on search criteria. Please refine your search and try again\n at Object.errorHandler (/opt/ibm/identity-mgmt/util/identity-util.js:61:17)\n at CorkedEmitter.<anonymous> (/opt/ibm/identity-mgmt/util/usergroup-util.js:345:56)\n at CorkedEmitter.emit (node:events:513:28)\n at CorkedEmitter.emit (/opt/ibm/identity-mgmt/node_modules/ldapjs/lib/corked_emitter.js:44:33)\n at sendResult (/opt/ibm/identity-mgmt/node_modules/ldapjs/lib/client/client.js:1194:22)\n at messageCallback (/opt/ibm/identity-mgmt/node_modules/ldapjs/lib/client/client.js:1220:18)\n at Parser.onMessage (/opt/ibm/identity-mgmt/node_modules/ldapjs/lib/client/client.js:888:14)\n at Parser.emit (node:events:513:28)\n at Parser.write (/opt/ibm/identity-mgmt/node_modules/ldapjs/lib/messages/parser.js:107:8)\n at Socket.onData (/opt/ibm/identity-mgmt/node_modules/ldapjs/lib/client/client.js:875:22)\n at Socket.emit (node:events:513:28)\n at addChunk (node:internal/streams/readable:324:12)\n at readableAddChunk (node:internal/streams/readable:297:9)\n at Readable.push (node:internal/streams/readable:234:10)\n at TCP.onStreamRead (node:internal/stream_base_commons:190:23) {\n status: 400\n },\n isOperational: true,\n status: 400\n}","time":"2023-04-19T10:39:08.706Z","v":0}
{"name":"platform-identity-mgmt","hostname":"auth-idp-7b4646b8b5-r8dn5","pid":1,"level":50,"msg":"usergroup:: Error: Bad request, LDAP group could not be found based on search criteria. Please refine your search and try again","time":"2023-04-19T10:39:08.706Z","v":0}
{"name":"platform-identity-mgmt","hostname":"auth-idp-7b4646b8b5-r8dn5","pid":1,"level":30,"msg":"usergroup:: Exiting /getUsers with error","time":"2023-04-19T10:39:08.706Z","v":0}
Unhandled error for request GET /usergroup/cip-cluster-admin-deve/getUsers: Error: Bad request, LDAP group could not be found based on search criteria. Please refine your search and try again
at Object.errorHandler (/opt/ibm/identity-mgmt/util/identity-util.js:61:17)
at /opt/ibm/identity-mgmt/common/models/user-group.js:241:48
at /opt/ibm/identity-mgmt/util/usergroup-util.js:456:32
at tryCatcher (/opt/ibm/identity-mgmt/node_modules/bluebird/js/release/util.js:16:23)
at Promise._settlePromiseFromHandler (/opt/ibm/identity-mgmt/node_modules/bluebird/js/release/util.js:547:31)
at Promise._settlePromise (/opt/ibm/identity-mgmt/node_modules/bluebird/js/release/util.js:604:18)
at Promise._settlePromise0 (/opt/ibm/identity-mgmt/node_modules/bluebird/js/release/util.js:649:10)
at Promise._settlePromises (/opt/ibm/identity-mgmt/node_modules/bluebird/js/release/util.js:725:18)
at _drainQueueStep (/opt/ibm/identity-mgmt/node_modules/bluebird/js/release/async.js:93:12)
at _drainQueue (/opt/ibm/identity-mgmt/node_modules/bluebird/js/release/async.js:86:9)
at Async._drainQueues (/opt/ibm/identity-mgmt/node_modules/bluebird/js/release/async.js:102:5)
at Async.drainQueues (/opt/ibm/identity-mgmt/node_modules/bluebird/js/release/async.js:15:14)
at process.processImmediate (node:internal/timers:476:21)
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSRV9V","label":"IBM Cloud Pak foundational services"},"ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SS8QTD","label":"IBM Cloud Pak for Integration"},"ARM Category":[{"code":"a8m0z0000001hogAAA","label":"Common Services"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB76","label":"Data Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SS2JQC","label":"IBM Cloud Pak for Automation"},"ARM Category":[{"code":"a8m50000000L1THAA0","label":"Business Console-\u003EConfiguration from UI-\u003EUser and group"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Log InLog in to view more of this document
This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.
Was this topic helpful?
Document Information
Modified date:
14 September 2026
UID
ibm16989183