# Can't get AD ldap to work
**URL:** https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [September 18, 2020, 8:35pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174 "2020-09-18T20:35:05Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Jay9x](https://discuss.elastic.co/u/Jay9x)
#### Post date: [September 18, 2020, 8:35pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/1 "2020-09-18T20:35:05Z")
Keep getting this error in the elasticsearch.log.
Authentication to realm ldap failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), diagnosticMessage='80090308: LdapErr: DSID-0C090446, comment: AcceptSecurityContext error, data 52e, v4563', ldapSDKVersion=4.0.8, revision=28812))
I've verified the account I have in the elasticsearch.yml for access ldap does work in another ldap browser. Also verified the accounts I'm signing into works as well in different applications. I did run the elasticsearch-keystore command to update the password for the bind account.
The cert list is the Issuing CA for the DC being used for ldap. It works perfectly on another server I used to do ldaps.
Below is my elasticsearch.yml
xpack.security.enabled: true
xpack:
security:
authc:
realms:
active\_directory:
ldap:
order: 0
domain\_name: mydomain.abc
url: "ldaps://dc.mydomain.abc:636"
bind\_dn: "CN=ldapAccount,OU=Users,DC=mydomain,DC=abc"
user\_search:
base\_dn: "DC=mydomain,DC=abc"
filter: "(sAMAccountName={0})"
upn\_filter: "(&(objectClass=user)(sAMAccountName={0}))"
group\_search:
base\_dn: "DC=mydomain,DC=abc"
ssl:
certificate\_authorities: ["tls/CA\_Cert.cer"]
files:
role\_mapping: "role\_mappings.yml"
unmapped\_groups\_as\_roles: false
`
Below is my role\_mappings.yml.
`
monitoring:
- "cn=elkadmins,dc=mydomain,dc=abc"
user:
- "cn=elkusers,dc=mydomain,dc=abc"
- "cn=elkadmins,dc=mydomain,dc=abc"
Appreciate any help or clues as to what maybe wrong.
---
### Author:  [@Iker](https://discuss.elastic.co/u/Iker)
#### Post date: [September 18, 2020, 10:06pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/2 "2020-09-18T22:06:34Z")
Try to specify the OU in the base\_dn for the user search
```auto
"OU=Myusers,DC=mydomain,DC=abc"
```
---
### Author:  [@Jay9x](https://discuss.elastic.co/u/Jay9x)
#### Post date: [September 18, 2020, 10:36pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/3 "2020-09-18T22:36:30Z")
Thx for the suggestions. I had tried that earlier, but got the same error. I tried it again, and changed both entries in the elasticsearch.yml and the role\_mappings.yml and added the OU=Users,DC=mydomain,DC=abc" but still get the same error. ☹ Been literally bashing my head in all day trying to get it to work with either ldap or ldaps. Such a pain. I have another linux server I'm using for SSO that authenticates through the same ldap server using the same cert just fine.
---
### Author:  [@Iker](https://discuss.elastic.co/u/Iker)
#### Post date: [September 19, 2020, 8:39pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/4 "2020-09-19T20:39:15Z")
This is my current setup, i had the same error, and the only fix was the ou; try getting incrementally, first just the user auth, then the groups and role mapping.
```
xpack:
security:
authc:
realms:
native:
es_native:
order: 0
active_directory:
my_ad:
order: 1
domain_name: my.dc
url: ldap://10.10.1.100:389
user_search:
base_dn: "OU=MyUserOU,DC=my,DC=dc"
bind_dn: elasticservice@my.dc
```
I try with ldap instead of ad and dn for the account but neither was succesfull, this config was the only one that really works.
---
### Author:  [@Jay9x](https://discuss.elastic.co/u/Jay9x)
#### Post date: [September 20, 2020, 12:57am UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/5 "2020-09-20T00:57:34Z")
Ok should "my\_ad" be exactly that? If not assume my AD domain tree is "[domain.com](http://domain.com)".
---
### Author:  [@Iker](https://discuss.elastic.co/u/Iker)
#### Post date: [September 20, 2020, 2:21am UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/6 "2020-09-20T02:21:30Z")
Not really, is just the name for the realm, when you store the password in the keystore you reference the property with that name.
---
### Author:  [@Jay9x](https://discuss.elastic.co/u/Jay9x)
#### Post date: [September 21, 2020, 1:59pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/7 "2020-09-21T13:59:58Z")
Cool beans. Well I got it authenticating it seems. I guess most of my problem was I was trying to use just the samaccountname or userprincipalname and didn't realize you had to use domain\user.
But now it does sign in, but the user doesn't have permissions to access anything. I get the screen below.
I tried adding the role mappings setting back with the users I wanted to have monitor and user access, but it doesn't seem to be working. Getting this error in the elasticsearch.log
[ERROR][o.e.x.s.a.e.NativeUsersStore] [node-1] security index is unavailable. short circuiting retrieval of user [domain\admin]
[INFO][o.e.x.s.a.s.m.NativeRoleMappingStore] [node-1] The security index is not yet available - no role mappings can be loaded
BTW thanks for the help, baby steps, but I'm getting there 🙂
---
### Author:  [@Iker](https://discuss.elastic.co/u/Iker)
#### Post date: [September 21, 2020, 4:25pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/8 "2020-09-21T16:25:05Z")
For the role mapping, you could do it through the UI in Kibana, in our cluster we don't have many users so the roles maps are pretty easy; you have to create a role, then the role mapping using the property of your preferences for the user, it's very flexible so you could use the group or OU mapping to get it to work ; this is an example:
---
### Author:  [@Jay9x](https://discuss.elastic.co/u/Jay9x)
#### Post date: [September 21, 2020, 5:12pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/9 "2020-09-21T17:12:07Z")
Would I need to disable my security settings first then go to this page to add users, then enable security in elasticsearch.yml? Cause with security enabled and ldap setup, the user I sign in with only gets that one page I sent in the last post. It's not letting me access kibana.
---
### Author:  [@Iker](https://discuss.elastic.co/u/Iker)
#### Post date: [September 21, 2020, 7:26pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/10 "2020-09-21T19:26:01Z")
No, just use the elastic built in user to make the set up or other local account, be aware that in your elasticsearch.yml file, you need the realm for native authentication(In my example file, is the native realm with order 0), otherwise the local accounts aren't going to work.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 19, 2020, 7:26pm UTC](https://discuss.elastic.co/t/cant-get-ad-ldap-to-work/249174/11 "2020-10-19T19:26:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.