# How config Elastic to use LDAP on Kibana

**URL:** <https://discuss.elastic.co/t/how-config-elastic-to-use-ldap-on-kibana/249170>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [September 18, 2020, 8:12pm UTC](https://discuss.elastic.co/t/how-config-elastic-to-use-ldap-on-kibana/249170 "2020-09-18T20:12:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafael\_Valverde](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafael_valverde/32/47247_2.png) [@Rafael\_Valverde](https://discuss.elastic.co/u/Rafael_Valverde)\
**Post date:** [September 18, 2020, 8:12pm UTC](https://discuss.elastic.co/t/how-config-elastic-to-use-ldap-on-kibana/249170/1 "2020-09-18T20:12:29Z")

</div>

We are trying to config LDAP on elastic to enable LDAP authentication on Kibana, following this guide:[https://www.elastic.co/guide/en/elasticsearch/reference/current/ldap-realm.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ldap-realm.html)

See my current config bellow also. Thanks

After make our configuration we are getting the bellow error:

```auto
com.unboundid.ldap.sdk.LDAPException: 0000208F: NameErr: DSID-03100225, problem 2006 (BAD_NAME), data 8349, best match of:
	'(&(objectCategory=Person)(sAMAccountName=*)(|(memberOf=CN=itt_admin,OU=devcentral,OU=appgroups,OU=accessmgmnt,DC=ers,DC=company,DC=com)))'

	at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils.toException(LdapUtils.java:407) ~[x-pack-security-7.9.0.jar:7.9.0]
	at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils.access$200(LdapUtils.java:53) ~[x-pack-security-7.9.0.jar:7.9.0]
	at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils$LdapSearchResultListener.searchResultReceived(LdapUtils.java:514) [x-pack-security-7.9.0.jar:7.9.0]
	at com.unboundid.ldap.sdk.AsyncSearchHelper.responseReceived(AsyncSearchHelper.java:245) [unboundid-ldapsdk-4.0.8.jar:4.0.8]
	at com.unboundid.ldap.sdk.LDAPConnectionReader.run(LDAPConnectionReader.java:516) [unboundid-ldapsdk-4.0.8.jar:4.0.8] Preformatted text`

elacticsearch.yml:

xpack.security.enabled: true

xpack:
  security:
    authc:
      realms:
        ldap:
          ldap1:
            order: 0
            url: "ldaps://ldap-bb.ers.company.com:636"
            bind_dn: "cn=crowdapp,ou=serviceaccounts,ou=accounts,ou=accessmgmnt,dc=ers,dc=company,dc=com"
            user_search:
              base_dn: "OU=accessmgmnt,DC=ers,DC=equifax,DC=com"
              filter: "(cn={0})"
            group_search:
              base_dn: "(&(objectCategory=Person)(sAMAccountName=*)(|(memberOf=CN=itt_admin,OU=devcentral,OU=appgroups,OU=accessmgmnt,DC=ers,DC=company,DC=com)))"
            files:
              role_mapping: "/opt/elk/elasticsearch/role_mapping.yml"
            unmapped_groups_as_roles: false

role_mapping.yml:

#roleA: this is an elasticsearch role
# - groupA-DN this is a group distinguished name
# - groupB-DN
# - user1-DN this is the full user distinguished name

superuser:
  - "cn=rxv112,ou=useraccounts,ou=accounts,dc=ers,dc=company,dc=com"
#  
user:
  - "CN=itt_admin,OU=devcentral,OU=appgroups,OU=accessmgmnt,DC=ers,DC=company,DC=com"
# - "cn=John Doe,cn=other users,dc=example,dc=com"
```

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [September 19, 2020, 1:49am UTC](https://discuss.elastic.co/t/how-config-elastic-to-use-ldap-on-kibana/249170/2 "2020-09-19T01:49:46Z")

</div>

Do you have at least a Gold license? [This](https://www.elastic.co/subscriptions) seems to say it won't work in the free licenses.

---

<div class="post-metadata">

**Author:** ![Rafael\_Valverde](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafael_valverde/32/47247_2.png) [@Rafael\_Valverde](https://discuss.elastic.co/u/Rafael_Valverde)\
**Post date:** [September 24, 2020, 11:13pm UTC](https://discuss.elastic.co/t/how-config-elastic-to-use-ldap-on-kibana/249170/3 "2020-09-24T23:13:02Z")

</div>

> [@rugenl](#):
>
> Do you have at least a Gold license? [This](https://www.elastic.co/subscriptions) seems to say it won't work in the free licenses.

It is working now, yes, we had the trial license, but I missed one step, I had to create a role and POST the role via API after make the LDAP config.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2020, 11:13pm UTC](https://discuss.elastic.co/t/how-config-elastic-to-use-ldap-on-kibana/249170/4 "2020-10-22T23:13:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.