# Authentication to realm active\_directory failed **URL:** \ **Category:** Elasticsearch\ **Created:** [September 27, 2018, 7:14am UTC](https://discuss.elastic.co/t/authentication-to-realm-active-directory-failed/150130 "2018-09-27T07:14:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![lcui\_dxc](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Post date:** [September 27, 2018, 7:14am UTC](https://discuss.elastic.co/t/authentication-to-realm-active-directory-failed/150130/1 "2018-09-27T07:14:31Z")
Hello there: I'm trying to set up X-pack to talk to our LDAP, but ran into issues. I have not set up SSL yet. Here is the elasticsearch.yml: xpack.monitoring.enabled: true xpack.monitoring.collection.enabled: true xpack.monitoring.collection.interval: 60s xpack.monitoring.collection.cluster.stats.timeout: 60s xpack.monitoring.history.duration: 90d xpack.watcher.history.cleaner\_service.enabled: true xpack.http.proxy.host: '[hlsoprxe1a-01.mycompany.com](http://hlsoprxe1a-01.mycompany.com)' xpack.http.proxy.port: 3128 xpack.watcher.enabled: true xpack.security.enabled: true # #---------------------------------- X-Pack and LDAP----------------------------------- xpack: security: authc: realms: active\_directory: type: active\_directory order: 0 domain\_name: [mycompany.com](http://mycompany.com) url: ldaps://ad-01.mycompany.com:3128 user\_search: base\_dn: "OU=SUDOers,DC=,DC=dxc,DC=com" attribute: cn bind\_dn: [myadmin@mycompany.com](mailto:myadmin@mycompany.com) bind\_password: mypassword When I started elasticsearch, I saw the following in the elasticsearch.log: ............ [2018-09-27T06:43:26,910][INFO][o.e.n.Node] [node-1] started [2018-09-27T06:43:28,114][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to connect to server [hlsoadse1a-01.hls.dxc.com:3128](http://hlsoadse1a-01.hls.dxc.com:3128): java.io.IOException: LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to establish a connection to server [hlsoadse1a-01.hls.dxc.com/10.100.16.11:3128:](http://hlsoadse1a-01.hls.dxc.com/10.100.16.11:3128:) ConnectException(message='Connection refused (Connection refused)', trace='socketConnect(PlainSocketImpl.java:native) / doConnect(AbstractPlainSocketImpl.java:350) / connectToAddress(AbstractPlainSocketImpl.java:206) / connect(AbstractPlainSocketImpl.java:188) / connect(SocksSocketImpl.java:392) / connect(Socket.java:589) / connect(SSLSocketImpl.java:673) / run(ConnectThread.java:146)', revision=24201)')')) [2018-09-27T06:43:28,179][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to connect to server [hlsoadse1a-01.hls.dxc.com:3128](http://hlsoadse1a-01.hls.dxc.com:3128): java.io.IOException: LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to establish a connection to server [hlsoadse1a-01.hls.dxc.com/10.100.16.11:3128:](http://hlsoadse1a-01.hls.dxc.com/10.100.16.11:3128:) ConnectException(message='Connection refused (Connection refused)', trace='socketConnect(PlainSocketImpl.java:native) / doConnect(AbstractPlainSocketImpl.java:350) / connectToAddress(AbstractPlainSocketImpl.java:206) / connect(AbstractPlainSocketImpl.java:188) / connect(SocksSocketImpl.java:392) / connect(Socket.java:589) / connect(SSLSocketImpl.java:673) / run(ConnectThread.java:146)', revision=24201)')')) ..... Please review and let us know what went wrong... Thanks a lot Li ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [September 27, 2018, 7:26am UTC](https://discuss.elastic.co/t/authentication-to-realm-active-directory-failed/150130/2 "2018-09-27T07:26:38Z")
Hi, The error, as clearly seen in the logs is: ```auto errorMessage='An error occurred while attempting to establish a connection to server hlsoadse1a-01.hls.dxc.com/10.100.16.11:3128: ConnectException(message='Connection refused (Connection refused)' ``` It looks like an AD server is not running on [hlsoadse1a-01.hls.dxc.com](http://hlsoadse1a-01.hls.dxc.com) ( 10.100.16.11 ) or it is not listening on port 3128. Can you verify that this is the correct host and port for your environment? ---
**Author:** ![lcui\_dxc](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Post date:** [September 27, 2018, 3:27pm UTC](https://discuss.elastic.co/t/authentication-to-realm-active-directory-failed/150130/3 "2018-09-27T15:27:17Z")
Loannis, Thanks for the response... I changed the configuration as below: xpack.monitoring.enabled: true xpack.monitoring.collection.enabled: true xpack.monitoring.collection.interval: 60s #cluster\_alerts.management.enabled: true xpack.monitoring.collection.cluster.stats.timeout: 60s xpack.monitoring.history.duration: 90d xpack.watcher.history.cleaner\_service.enabled: true xpack.http.proxy.host: '[proxyhost.xxx.yyy.com](http://proxyhost.xxx.yyy.com)' xpack.http.proxy.port: 3128 xpack.watcher.enabled: true xpack.security.enabled: true xpack: security: authc: realms: active\_directory: type: active\_directory order: 0 domain\_name: [xxx.yyy.com](http://xxx.yyy.com) ================= And got a different error: # [2018-09-27T14:40:38,202][INFO][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [node-1] publish\_address {10.100.35.182:9200}, bound\_addresses {elasitcIP:9200} [2018-09-27T14:40:38,202][INFO][o.e.n.Node] [node-1] started [2018-09-27T14:40:39,409][INFO][o.e.l.LicenseService] [node-1] license [ea071fcf-a30c-4bf3-bed6-de82629478ca] mode [trial] - valid [2018-09-27T14:40:39,422][INFO][o.e.g.GatewayService] [node-1] recovered [30] indices into cluster\_state [2018-09-27T14:40:40,891][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) [2018-09-27T14:40:40,990][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) [2018-09-27T14:40:41,118][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) [2018-09-27T14:40:41,190][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) [2018-09-27T14:40:42,712][INFO][o.e.c.r.a.AllocationService] [node-1] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[metricbeat-6.3.2-2018.08.30][0], [metricbeat-6.3.2-2018.08.27][0], [.kibana][0]] ...]). [2018-09-27T14:40:43,513][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) [2018-09-27T14:40:46,022][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) [2018-09-27T14:40:48,531][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) [2018-09-27T14:40:50,371][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) [2018-09-27T14:40:50,373][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) [2018-09-27T14:40:51,040][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) ... I did authentication as below.... seems to be fine... $ curl -k -u localuser '[http://10.100.35.182:9200/\_xpack/security/\_authenticate?pretty](http://10.100.35.182:9200/_xpack/security/_authenticate?pretty)' Enter host password for user 'CD021544': [ec2-user@xxxoelke1b-03 ~]$ curl -k -u localuser 'http://:9200/\_xpack/security/\_authenticate?pretty' Enter host password for user 'localuser': { "username" : "localuser", "roles" : [], "full\_name" : null, "email" : null, "metadata" : { "ldap\_dn" : "CN=localuser,CN=Users,DC=xxx,DC=yyy,DC=com", "ldap\_groups" : [ "CN=Administrators,CN=Builtin,DC=xxx,DC=yyy,DC=com", "CN=Users,CN=Builtin,DC=xxx,DC=yyy,DC=com", "CN=Remote Management Users,CN=Builtin,DC=xxx,DC=yyy,DC=com", "CN=Domain Admins,CN=Users,DC=xxx,DC=yyy,DC=com", "CN=Domain Users,CN=Users,DC=xxx,DC=yyy,DC=com", "CN=Cert Publishers,CN=Users,DC=xxx,DC=yyy,DC=com", "CN=Schema Admins,CN=Users,DC=xxx,DC=yyy,DC=com", "CN=Enterprise Admins,CN=Users,DC=xxx,DC=yyy,DC=com", "CN=Group Policy Creator Owners,CN=Users,DC=xxx,DC=yyy,DC=com", "CN=Denied RODC Password Replication Group,CN=Users,DC=xxx,DC=yyy,DC=com", "CN=DnsAdmins,CN=Users,DC=xxx,DC=yyy,DC=com" ] }, "enabled" : true } Please help to find out what went wrong and how to fix.. Thanks a lot in advance Li ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [September 27, 2018, 3:41pm UTC](https://discuss.elastic.co/t/authentication-to-realm-active-directory-failed/150130/4 "2018-09-27T15:41:25Z")
Please take the time to correctly format the logs in your message, this is very hard to read through ---
**Author:** ![lcui\_dxc](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Post date:** [September 27, 2018, 3:43pm UTC](https://discuss.elastic.co/t/authentication-to-realm-active-directory-failed/150130/5 "2018-09-27T15:43:31Z")
Sorry, this is the error in the elasticsearch.log, the same exception happened many times.. ===================== [2018-09-27T14:40:51,040][WARN][o.e.x.s.a.AuthenticationService] [node-1] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580')) # .... ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [September 28, 2018, 6:15am UTC](https://discuss.elastic.co/t/authentication-to-realm-active-directory-failed/150130/6 "2018-09-28T06:15:34Z")
My guess ( seeing that there is a `.metricbeat` index from your log output ) is that you have a Beat attempting to connect to Elasticsearch and to authenticate with a username/password for a user in the native realm. Since you have defined an AD realm, you need to [explicitly configure the native realm](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-native-realm.html) if you want to use this too. Now that you haven't, and since you have configured your AD realm without a bind user, Elasticsearch attempts to bind to AD with the credentials for the Beat user and fails producing these error messages. When authenticating with your `CD021544`, this succeeds as this is a user in AD and its password is correct. If the above assumption is not correct, please - Set the logging to DEBUG by setting ```auto logger.authc.name = org.elasticsearch.xpack.security.authc logger.authc.level = DEBUG ``` in your log4j2.log in the Elasticsearch configuration dir - Share a larger part of your Elasticsearch log that would give us some more insights. - Share additional information on your architecture, i.e. what other components of the Elastic stack you are using and relevant configuration. ---
**Author:** ![lcui\_dxc](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Post date:** [September 28, 2018, 9:33pm UTC](https://discuss.elastic.co/t/authentication-to-realm-active-directory-failed/150130/7 "2018-09-28T21:33:19Z")
Thanks, will try this ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 26, 2018, 9:33pm UTC](https://discuss.elastic.co/t/authentication-to-realm-active-directory-failed/150130/8 "2018-10-26T21:33:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.