# Authentication to realm ldap1 failed - authenticate failed

**URL:** <https://discuss.elastic.co/t/authentication-to-realm-ldap1-failed-authenticate-failed/270907>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 21, 2021, 9:57pm UTC](https://discuss.elastic.co/t/authentication-to-realm-ldap1-failed-authenticate-failed/270907 "2021-04-21T21:57:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Patr123](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@Patr123](https://discuss.elastic.co/u/Patr123)\
**Post date:** [April 21, 2021, 9:57pm UTC](https://discuss.elastic.co/t/authentication-to-realm-ldap1-failed-authenticate-failed/270907/1 "2021-04-21T21:57:46Z")

</div>

Hello All,  
I am trying to configure the LDAP realm in my elasticsearch using the document mentioned in the elastic site and having some issue. I am getting invalid user name and password message on kibana GUI.  
My Ldap settings in elasticsearch.yml files are:

```auto
xpack:
  security:
    authc:
      realms:
        ldap:
          ldap1:
            metadata: cn
            order: 0
            url: "ldap://1.2.3.4:389"
            bind_dn: "CN=serviceaccountES,OU=Service,OU=Accounts,DC=ad,DC=ad1,DC=com"
            user_search:
              base_dn: "OU=Employees,OU=Users,DC=ad,DC=ad1,DC=com"
              filter: "(cn={0})"
            group_search:
              base_dn: "OU=Groups,DC=ad,DC=ad1,DC=com"
            files:
              role_mapping: "/etc/elasticsearch/role_mapping.yml"
            unmapped_groups_as_roles: false

```

My role\_mapping file looks like:

```auto
cat /etc/elasticsearch/role_mapping.yml
# Role mapping configuration file which has elasticsearch roles as keys
# that map to one or more user or group distinguished names

#roleA: this is an elasticsearch role
# - groupA-DN this is a group distinguished name
# - groupB-DN
# - user1-DN this is the full user distinguished name

superuser:
 - "cn=elasticsearch_admin,ou=groups,dc=ad,dc=ad1,dc=com"
#user:
# - "cn=users,dc=example,dc=com"
# - "cn=admins,dc=example,dc=com"

```

My elasticsearch.log file gives the following error:

```auto
[2021-04-21T20:55:39,695][WARN][o.e.x.s.a.AuthenticationService] [ELKServer01] Authentication to realm ldap1 failed - authenticate failed (Caused by LDAPException(resultCode=32 (no such object), errorMessage='0000208D: NameErr: DSID-03100238, problem 2001 (NO_OBJECT), data 0, best match of:
        'DC=ad,DC=ad1,DC=com'
', matchedDN='DC=ad,DC=ad1,DC=com', ldapSDKVersion=4.0.8, revision=28812))

```

I am not able to find anything related to the error message I am getting. Can someone please help me out on this?

Thank you.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [April 22, 2021, 5:12am UTC](https://discuss.elastic.co/t/authentication-to-realm-ldap1-failed-authenticate-failed/270907/2 "2021-04-22T05:12:41Z")

</div>

Judging by the error, one of

```auto
              base_dn: "OU=Employees,OU=Users,DC=ad,DC=ad1,DC=com"

```

```auto
              base_dn: "OU=Groups,DC=ad,DC=ad1,DC=com"

```

are wrong. Do these organizational units exist in your LDAP server ?

Also, it looks like you are connecting to an Active Directory, you should better use our Active Directory realm instead of the LDAP realm, unless you have a very specific reason not to.

---

<div class="post-metadata">

**Author:** ![Patr123](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@Patr123](https://discuss.elastic.co/u/Patr123)\
**Post date:** [April 22, 2021, 12:29pm UTC](https://discuss.elastic.co/t/authentication-to-realm-ldap1-failed-authenticate-failed/270907/3 "2021-04-22T12:29:04Z")

</div>

Hello ikakavas,  
Yes, these OU does exist in my LDAP server. I double checked and its all there. Yes, this is an active directory and I tried using the AD realm but it was giving me a different error. Let me try again and tell you the exact error I got with it.

---

<div class="post-metadata">

**Author:** ![Patr123](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@Patr123](https://discuss.elastic.co/u/Patr123)\
**Post date:** [April 23, 2021, 2:53pm UTC](https://discuss.elastic.co/t/authentication-to-realm-ldap1-failed-authenticate-failed/270907/4 "2021-04-23T14:53:38Z")

</div>

I was able to configure the ldap realm actually. It was always working. I was using sAMAccountName to login instead of CN. Once I changed that my ldap config started working.  
Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2021, 2:54pm UTC](https://discuss.elastic.co/t/authentication-to-realm-ldap1-failed-authenticate-failed/270907/5 "2021-05-21T14:54:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.