# Elasticsearch Active-Directory Authentication Failure

**URL:** <https://discuss.elastic.co/t/elasticsearch-active-directory-authentication-failure/241032>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [July 13, 2020, 7:35pm UTC](https://discuss.elastic.co/t/elasticsearch-active-directory-authentication-failure/241032 "2020-07-13T19:35:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [July 13, 2020, 7:35pm UTC](https://discuss.elastic.co/t/elasticsearch-active-directory-authentication-failure/241032/1 "2020-07-13T19:35:08Z")

</div>

Elasticsearch: 7.8  
Below is my xpack conf:

```auto
xpack:
  security:
    authc:
      realms:
        active_directory:
          corp_ad:
            order: 0
            domain_name: <Domain-Name>
            follow_referrals: false
            url: ldaps://<AD-Hostname>:636
            bind_dn: <username>
            bind_password: <password>
            ssl:
              certificate_authorities: ["/etc/elasticsearch/certs/ca-cert.pem"]

```

But getting the below warn message and also auth-failure when trying when I restart elasticsearch:

```auto
[WARN][o.e.x.s.a.AuthenticationService] [<elasticsearch-1-host>] Authentication to realm corp_ad failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), diagnosticMessage='80090308: LdapErr: DSID-0C090434, comment: AcceptSecurityContext error, data 52e, v4563', ldapSDKVersion=4.0.8, revision=28812))

```

Please suggest

---

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [July 13, 2020, 9:27pm UTC](https://discuss.elastic.co/t/elasticsearch-active-directory-authentication-failure/241032/2 "2020-07-13T21:27:06Z")

</div>

From debugging the logs, I notice that elasticsearch is searching the elastic built-in accounts on active-directory which obviously won't exist.

[2020-07-13T20:37:16,419][TRACE][o.e.x.s.a.AuthenticationService] [] Found existing authentication [Authentication[User[username=\_system,roles=[\_system],fullName=null,email=null,metadata={}],type=INTERNAL,by={Realm[\_\_attach.\_\_attach] on Node[[elasticsearch-3.Host-Name](http://elasticsearch-3.Host-Name/)]}]] in request [transport request action [internal:coordination/fault\_detection/follower\_check]]

[2020-07-13T20:37:16,563][TRACE][o.e.x.s.a.AuthenticationService] [] Found existing authentication [Authentication[User[username= **logstash\_admin\_user** ,roles=[logstash\_admin,logstash\_reader,logstash\_writer],fullName=Logstash XPack Mgmt ,email= **logstash@** ,metadata={}],type=REALM,by={Realm[native.default\_native] on Node[[elasticsearch-3.Host-Name](http://elasticsearch-3.%3CHostname%3E/)]}]] in request [transport request action [indices:data/read/mget[shard][s]]]

[2020-07-13T20:37:16,570][TRACE][o.e.x.s.a.AuthenticationService] [] Found authentication credentials [org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken] for principal [logstash\_admin\_user] in request [rest request uri [/]]

```auto
[2020-07-13T20:37:16,578][DEBUG][o.e.x.s.a.l.LdapRealm] [<Elasticsearch-Host>] Exception occurred during authenticate for active_directory/corp_ad
com.unboundid.ldap.sdk.LDAPBindException: 80090308: LdapErr: DSID-0C090434, comment: AcceptSecurityContext error, data 52e, v4563 
at com.unboundid.ldap.sdk.LDAPConnection.bind(LDAPConnection.java:2273) ~[unboundid-ldapsdk-4.0.8.jar:4.0.8]
at com.unboundid.ldap.sdk.LDAPConnectionPool.bindAndRevertAuthentication(LDAPConnectionPool.java:1619) ~[unboundid-ldapsdk-4.0.8.jar:4.0.8]
at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils$1.lambda$doRun$0(LdapUtils.java:135) ~[x-pack-security-7.8.0.jar:7.8.0]
at java.security.AccessController.doPrivileged(AccessController.java:554) ~[?:?]
at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils.privilegedConnect(LdapUtils.java:74) ~[x-pack-security-7.8.0.jar:7.8.0]
at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils$1.doRun(LdapUtils.java:135) [x-pack-security-7.8.0.jar:7.8.0]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-7.8.0.jar:7.8.0]
at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils.maybeForkAndRun(LdapUtils.java:100) [x-pack-security-7.8.0.jar:7.8.0]
at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils.maybeForkThenBindAndRevert(LdapUtils.java:151) [x-pack-security-7.8.0.jar:7.8.0]
at org.elasticsearch.xpack.security.authc.ldap.ActiveDirectorySessionFactory$ADAuthenticator.authenticate(ActiveDirectorySessionFactory.java:285) [x-pack-security-7.8.0.jar:7.8.0]
at org.elasticsearch.xpack.security.authc.ldap.ActiveDirectorySessionFactory.getSessionWithPool(ActiveDirectorySessionFactory.java:116) [x-pack-security-7.8.0.jar:7.8.0]
at org.elasticsearch.xpack.security.authc.ldap.PoolingSessionFactory.session(PoolingSessionFactory.java:96) [x-pack-security-7.8.0.jar:7.8.0]
at org.elasticsearch.xpack.security.authc.ldap.LdapRealm.lambda$doAuthenticate$1(LdapRealm.java:131) [x-pack-security-7.8.0.jar:7.8.0]
at org.elasticsearch.xpack.security.authc.ldap.LdapRealm$CancellableLdapRunnable.doRun(LdapRealm.java:314) [x-pack-security-7.8.0.jar:7.8.0]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:695) [elasticsearch-7.8.0.jar:7.8.0]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-7.8.0.jar:7.8.0]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) [?:?]
at java.lang.Thread.run(Thread.java:832) [?:?]

```

[2020-07-13T20:37:16,578][DEBUG][o.e.x.s.a.AuthenticationService] [] Authentication of [**logstash\_admin\_user**] using realm [active\_directory/corp\_ad] with token [UsernamePasswordToken] was [AuthenticationResult{status=CONTINUE, user=null, message=authenticate failed, exception=LDAPException(resultCode=49 (invalid credentials), diagnosticMessage='80090308: LdapErr: DSID-0C090434, comment: AcceptSecurityContext error, data 52e, v4563 ', ldapSDKVersion=4.0.8, revision=28812)}]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2020, 9:27pm UTC](https://discuss.elastic.co/t/elasticsearch-active-directory-authentication-failure/241032/3 "2020-08-10T21:27:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.