# ElasticSearch ( 5.5.2 ) X-Pack Active Directory Authentication Fails **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 30, 2018, 12:04pm UTC](https://discuss.elastic.co/t/elasticsearch-5-5-2-x-pack-active-directory-authentication-fails/154648 "2018-10-30T12:04:54Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ramkrishna.cignex](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@ramkrishna.cignex](https://discuss.elastic.co/u/ramkrishna.cignex)\ **Post date:** [October 30, 2018, 12:04pm UTC](https://discuss.elastic.co/t/elasticsearch-5-5-2-x-pack-active-directory-authentication-fails/154648/1 "2018-10-30T12:04:54Z")
Hi, I am using Elasticsearch and X-pack version 5.5.2. I am trying to configure X-Pack with Active directory and I am getting following error. > [2018-10-30T17:11:07,895][WARN][o.e.x.s.a.AuthenticationService] [local-node] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=81 (server down), errorMessage='The connection to server xx.xx.xx.xx:636 was closed while waiting for a response to a bind request SimpleBindRequest(dn='user@domain.com'): An I/O error occurred while trying to read the response from the server: SocketException(message='Software caused connection abort: recv failed', trace='socketRead0(null:native) / socketRead(null:unknown) / read(null:unknown) / read(null:unknown) / fill(null:unknown) / read(null:unknown) / read(ASN1StreamReader.java:992) / readType(ASN1StreamReader.java:329) / beginSequence(ASN1StreamReader.java:912) / readLDAPResponseFrom(LDAPMessage.java:1146) / run(LDAPConnectionReader.java:251)', revision=24201)')) Configuration in elasticsearch.yml : ```auto xpack: security: authc: realms: active_directory: type: active_directory order: 0 domain_name: domain.com url: ldap://xx.xx.xx.xx:636 unmapped_groups_as_roles: true follow_referrals: false ssl: certificate_authorities: ["./x-pack/cacert.pem"] ``` Configuration in role\_mapping.yml: ```auto superuser: - "cn=UserGroupName,dc=domain,dc=com" - "cn=SpecificUserID,dc=domain,dc=com" ``` I am using cacert.pem file generated by following command: ```auto openssl s_client -showcerts -connect XX.XX.XX.XX:636 /dev/null|openssl x509 -outform PEM >cacert.pem ``` Please let me know what should I fix to make AD authentication work. Thank You. Ram. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 31, 2018, 6:28am UTC](https://discuss.elastic.co/t/elasticsearch-5-5-2-x-pack-active-directory-authentication-fails/154648/2 "2018-10-31T06:28:50Z")
You need to denote that your LDAP server uses SSL in your confguration, so please change ```auto url: ldap://xx.xx.xx.xx:636 ``` to ```auto url: ldaps://xx.xx.xx.xx:636 ``` ---
**Author:** ![ramkrishna.cignex](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@ramkrishna.cignex](https://discuss.elastic.co/u/ramkrishna.cignex)\ **Post date:** [October 31, 2018, 8:37am UTC](https://discuss.elastic.co/t/elasticsearch-5-5-2-x-pack-active-directory-authentication-fails/154648/3 "2018-10-31T08:37:27Z")
@ikakavas I tried to use **ldaps** but it end up with following error in log: > [2018-10-31T14:04:20,405][WARN][o.e.x.s.a.AuthenticationService] [local-node] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to connect to server xx.xx.xx.xx:636: java.io.IOException: LDAPException(resultCode=91 (connect error), errorMessage='Hostname verification failed because the expected hostname 'xx.xx.xx.xx' was not found in peer certificate 'subject='[CN=ABCD.XYZ.domain.com](http://CN=ABCD.XYZ.domain.com)''.')')) Please suggest. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 31, 2018, 8:59am UTC](https://discuss.elastic.co/t/elasticsearch-5-5-2-x-pack-active-directory-authentication-fails/154648/4 "2018-10-31T08:59:49Z")
As explicitly called out by the error, hostname verification fails for your LDAP server's certificate. This is because you use the server's IP address in your ldaps URL and the server's certificate only contain it's FQDN. You can either - use `ABCD.XYZ.domain.com` instead of the IP address in your - or set ---
**Author:** ![ramkrishna.cignex](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@ramkrishna.cignex](https://discuss.elastic.co/u/ramkrishna.cignex)\ **Post date:** [October 31, 2018, 1:12pm UTC](https://discuss.elastic.co/t/elasticsearch-5-5-2-x-pack-active-directory-authentication-fails/154648/5 "2018-10-31T13:12:09Z")
Hello @ikakavas, It was spot on !! I can log in to Elasticsearch and Kibana using AD now. Thank you very much. Regards, Ram. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2018, 1:12pm UTC](https://discuss.elastic.co/t/elasticsearch-5-5-2-x-pack-active-directory-authentication-fails/154648/6 "2018-11-28T13:12:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.