# Enabling LDAP and authentication isssue **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 6, 2019, 7:01am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034 "2019-03-06T07:01:14Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![B123](https://avatars.discourse-cdn.com/v4/letter/b/5fc32e/32.png) [@B123](https://discuss.elastic.co/u/B123)\ **Post date:** [March 6, 2019, 7:01am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/1 "2019-03-06T07:01:14Z")
Hi, I am trying to enable the LDAP authentiaction realm for my elasticsearch instance using the configurations in elasticsearch.yml: xpack.security.authc.realms.ldap.type: ldap xpack.security.authc.realms.ldap.order: 1 xpack.security.authc.realms.ldap.domain\_name: xpack.security.authc.realms.ldap.url: [list of URLs] xpack.security.authc.realms.ldap.user\_dn\_templates: "CN=XXXX,OU=XX,DC=X" xpack.security.authc.realms.ldap.ssl.verification\_mode: certificate xpack.security.authc.realms.ldap.ssl.certificate\_authorities: ["cert\_name"] Getting the below error in es logs while trying to hit the es URL using the CN specified in my settings and password. Authentication to realm ldap failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 52e, v1db1', diagnosticMessage='80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 52e, v1db1')) And if i replace xpack.security.authc.realms.ldap.user\_dn\_templates: "CN=XXXX,OU=XX,DC=X" by xpack.security.authc.realms.ldap.user\_search.base\_dn: "DC=X" I am getting below error, Authentication to realm ldap2 failed - authenticate failed (Caused by LDAPException(resultCode=1 (operations error), errorMessage='000004DC: LdapErr: DSID-0C09075A, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1')) Thanks in advance. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 6, 2019, 11:17am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/2 "2019-03-06T11:17:55Z")
> [@B123](#): > > xpack.security.authc.realms.ldap.user\_dn\_templates: "CN=XXXX,OU=XX,DC=X" It's hard to be sure exactly what you've done since you've redacted the value, but the template needs to include `{0}` somewhere in it so that we can substitute in the id of user who is authenticating. If you put a full DN there, then we'll authenticate as that DN, but use that password provided by the user who is logging in to ES. > [@B123](#): > > xpack.security.authc.realms.ldap.user\_search.base\_dn: "DC=X" You LDAP server is configured to require authenticated binds before searching. If you want to use `user_search` mode then you'll need to provide a `bind_dn` and password as well so that we can connect to the LDAP server and search for the user. ---
**Author:** ![B123](https://avatars.discourse-cdn.com/v4/letter/b/5fc32e/32.png) [@B123](https://discuss.elastic.co/u/B123)\ **Post date:** [March 8, 2019, 9:15am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/3 "2019-03-08T09:15:16Z")
Thanks for the reply @TimV Can you please explain the part where you have mentioned the template needs to include `{0}` somewhere in it so that we can substitute in the id of user who is authenticating. Did it mean the below: `user_dn_templates:` `- "cn={0}, ou=users, o=marketing, dc=example, dc=com"` `- "cn={0}, ou=users, o=engineering, dc=example, dc=com"` While using the above and removing `user_search` mode i am getting the below error: Authentication to realm ldap failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 52e, v1db1', diagnosticMessage='80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 52e, v1db1')) And i do not intend to use the `user_search` mode ---
**Author:** ![B123](https://avatars.discourse-cdn.com/v4/letter/b/5fc32e/32.png) [@B123](https://discuss.elastic.co/u/B123)\ **Post date:** [March 18, 2019, 7:14am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/4 "2019-03-18T07:14:11Z")
Any updates on this issue team. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 18, 2019, 7:47am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/5 "2019-03-18T07:47:38Z")
If you use: > [@B123](#): > > `user_dn_templates:` > `- "cn={0}, ou=users, o=marketing, dc=example, dc=com"` > `- "cn={0}, ou=users, o=engineering, dc=example, dc=com"` and you try to login as B123 for instance, Elasticsearch will try to bind to your LDAP server as `cn=B123,ou=users, o=marketing, dc=example, dc=com` as it will replace `{0}` with the userid you use while logging in. So, it means that you need to set your `user_dn_templates` accordingly so that after replacing the `{0}` with whatever the user enters on login, the result will be a valid DN in your LDAP. Is that clearer now ? ---
**Author:** ![B123](https://avatars.discourse-cdn.com/v4/letter/b/5fc32e/32.png) [@B123](https://discuss.elastic.co/u/B123)\ **Post date:** [March 18, 2019, 8:31am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/6 "2019-03-18T08:31:11Z")
Yes @ikakavas . Thanks a Lot!!! I set `user_dn_templates` accordingly so that after replacing the `{0}` with whatever the user enters on login, the result will be a valid DN in my LDAP. But stilll i am getting the below error. Thats why i am clue less , on how to proceed. Authentication to realm ldap failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 52e, v1db1', diagnosticMessage='80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 52e, v1db1')) Thanks in Advance. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 18, 2019, 8:33am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/7 "2019-03-18T08:33:00Z")
> AcceptSecurityContext error, data 52e, This error code from Active Directory means "wrong credentials", so the best guess here is that either the DN or the password of that user is wrong. Can you try and bind directly to the AD using the DN and password to verify these are valid ? ---
**Author:** ![B123](https://avatars.discourse-cdn.com/v4/letter/b/5fc32e/32.png) [@B123](https://discuss.elastic.co/u/B123)\ **Post date:** [March 18, 2019, 8:40am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/8 "2019-03-18T08:40:23Z")
@ikakavas Now i included the bind\_dn and bind\_passoword and tried . I am getting the below error. Authentication to realm ldap failed - authenticate failed (Caused by LDAPException(resultCode=85 (timeout), errorMessage='The asynchronous operation encountered a client-side timeout after waiting 4999 milliseconds for a response to arrive.')) What could be the possible error Thanks in Advance! ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 18, 2019, 8:46am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/9 "2019-03-18T08:46:52Z")
> [@B123](#): > > Now i included the bind\_dn and bind\_passoword and tried . I am getting the below error. Can you please be a little more explicit ? You added _which_ `bind_dn` and _which_ `bind_password` and _where_ ? > [@B123](#): > > What could be the possible error Your server did not reply to the bind request within 5 seconds. I just noticed that you are using an LDAP realm while your backend server is Active Directory. Please change that to use an [Active Directory realm](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/configuring-ad-realm.html) instead. ---
**Author:** ![B123](https://avatars.discourse-cdn.com/v4/letter/b/5fc32e/32.png) [@B123](https://discuss.elastic.co/u/B123)\ **Post date:** [March 18, 2019, 8:50am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/10 "2019-03-18T08:50:39Z")
@ikakavas Thanks for the reply. I added the `bind_dn` and `bind_password` from my DN data in elasticsearch.yml along with user\_search.base\_dn. > I just noticed that you are using an LDAP realm while your backend server is Active Directory. Please change that to use an [Active Directory realm](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/configuring-ad-realm.html) instead. Could please elaborate the above response. Thanks in Advance! ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 18, 2019, 8:56am UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/11 "2019-03-18T08:56:35Z")
> [@B123](#): > > I added the `bind_dn` and `bind_password` from my DN data. Please take the time to add more information to your message, this will make it easier for people to help you out. What is this DN data ? Can you verify that this DN and this password are correct ( outside Elasticsearch ) . Can you use these to authenticate to your Active Directory ? We are getting an error saying that these credentials are wrong, so you should first verify that these are correct , before attempting to troubleshoot your Elasticsearch configuration. > [@B123](#): > > Could please elaborate the above response. You have configured an authentication realm of LDAP type ```auto xpack.security.authc.realms.ldap.type: ldap ``` but your error message indicates that your LDAP server, is _Actually_ an Active Directory Domain Controller. As such, you should better configure an authentication realm of Active Directory type ( See the link I shared in the previous message ) ---
**Author:** ![B123](https://avatars.discourse-cdn.com/v4/letter/b/5fc32e/32.png) [@B123](https://discuss.elastic.co/u/B123)\ **Post date:** [March 18, 2019, 1:01pm UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/12 "2019-03-18T13:01:05Z")
Hi @ikakavas, I have added the below configuration : xpack.security.authc.realms.ldap.type: ldap xpack.security.authc.realms.ldap.order: 1 xpack.security.authc.realms.ldap.url: "ldaps://ldap.example.com:636" xpack.security.authc.realms.ldap.bind\_dn: "cn=ldapuser, ou=users, o=services, dc=example, dc=com" xpack.security.authc.realms.ldap.bind\_password: password of user mentioned in cn xpack.security.authc.realms.ldap.user\_search.base\_dn: "dc=example,dc=com" And as you have mentioned: Your error message indicates that your LDAP server, is _Actually_ an Active Directory Domain Controller. As such, you should better configure an authentication realm of Active Directory type . I have used an LDAP URL "ldaps://ldap.example.com:636". Then what is the need to configure a Active Directory realm instead. Please guide me on this. I may not have proper knowledge about the exact difference in using LDAP or active directory as the realm type in settings. Thanks in Advance.! ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 18, 2019, 1:29pm UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/13 "2019-03-18T13:29:12Z")
Please read the documentation first . I have shared that link with you above already. It's very inefficient if we need to rewrite this every time a user needs to configure elasticsearch. Please put in some effort to do this or at least read through the docs and well be happy to help with specific issues once you have tried . ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 15, 2019, 1:29pm UTC](https://discuss.elastic.co/t/enabling-ldap-and-authentication-isssue/171034/14 "2019-04-15T13:29:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.