# OIDC and LDAP user mapping

**URL:** <https://discourse.openondemand.org/t/oidc-and-ldap-user-mapping/4560>\
**Category:** Get Help\
**Created:** [October 3, 2025, 3:04pm UTC](https://discourse.openondemand.org/t/oidc-and-ldap-user-mapping/4560 "2025-10-03T15:04:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![xpillons](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/xpillons/32/1256_2.png) [@xpillons](https://discourse.openondemand.org/u/xpillons)\
**Post date:** [October 3, 2025, 3:04pm UTC](https://discourse.openondemand.org/t/oidc-and-ldap-user-mapping/4560/1 "2025-10-03T15:04:12Z")

</div>

Our Open OnDemand machine is setup to use Open ID Connect to authenticate with EntraID, and has SSSD configured to use LDAP Auth. While we have got the EntraID auth correct when accessing the Open OnDemand main page, it failed on the user mapping. The error being this one

> Error – failed to map user (foo)

When we SSH on the OOD machine we can logon with user `foo` .

`id foo` and `su - foo` succeeded.

I’m looking for advice on where to look for detailed errors and if so how to increase the log vebocity ?

I don’t see anything in the apache2 logs.

Thank you for your help

Xavier

---

<div class="post-metadata">

**Author:** ![bsingleton](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/bsingleton/32/3343_2.png) [@bsingleton](https://discourse.openondemand.org/u/bsingleton)\
**Post date:** [October 3, 2025, 4:45pm UTC](https://discourse.openondemand.org/t/oidc-and-ldap-user-mapping/4560/2 "2025-10-03T16:45:28Z")

</div>

Hi Xavier,

What version of OOD are you running? Could you provide your `/etc/ood/config/ood_portal.yml`? This is the source of a lot of user mapping issues, specifically with the `user_map_match`.

For more verbosity in the error logs, you should set the lua log level to `debug` in ood-portal.yml. That should write an explicit log for user mapping that looks something like this

`Mapped ‘foo’ => ‘foo’`. If it shows it mapping to an empty string, that would point to the user\_map being the problem.

---

<div class="post-metadata">

**Author:** ![xpillons](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/xpillons/32/1256_2.png) [@xpillons](https://discourse.openondemand.org/u/xpillons)\
**Post date:** [October 3, 2025, 4:47pm UTC](https://discourse.openondemand.org/t/oidc-and-ldap-user-mapping/4560/3 "2025-10-03T16:47:32Z")

</div>

thanks for the reply. This is on OOD 4.0.7. I don’t have the ood\_portal.yml handy, but I will check this next monday.

---

<div class="post-metadata">

**Author:** ![xpillons](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/xpillons/32/1256_2.png) [@xpillons](https://discourse.openondemand.org/u/xpillons)\
**Post date:** [October 6, 2025, 2:18pm UTC](https://discourse.openondemand.org/t/oidc-and-ldap-user-mapping/4560/4 "2025-10-06T14:18:57Z")

</div>

thank you for your advice. the domain mapping was the issue, we tried to map with a domain while there were no domain.

All works now.

Thanks,

Xavier

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [April 4, 2026, 2:19pm UTC](https://discourse.openondemand.org/t/oidc-and-ldap-user-mapping/4560/5 "2026-04-04T14:19:11Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.