# How to validate ldap authenticaion on elasticsearch

**URL:** <https://discuss.elastic.co/t/how-to-validate-ldap-authenticaion-on-elasticsearch/199611>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [September 16, 2019, 8:44am UTC](https://discuss.elastic.co/t/how-to-validate-ldap-authenticaion-on-elasticsearch/199611 "2019-09-16T08:44:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikhil\_Pillai](https://avatars.discourse-cdn.com/v4/letter/n/e56c9b/32.png) [@Nikhil\_Pillai](https://discuss.elastic.co/u/Nikhil_Pillai)\
**Post date:** [September 16, 2019, 8:44am UTC](https://discuss.elastic.co/t/how-to-validate-ldap-authenticaion-on-elasticsearch/199611/1 "2019-09-16T08:44:32Z")

</div>

How do i validate if my ldap configuration on elasticsearch is proper or not.

```auto
xpack:
  security:
    authc:
      realms:
        ldap1:
          type: ldap
          order: 0
          url: "ldap://ldapauth.example.com:389"
          bind_dn: "ldapuser@example.com"
          user_search:
            base_dn: "dc=example,dc=com"
            filter: "(cn={0})"
          group_search:
            base_dn: "dc=example,dc=com"
          files:
            role_mapping: "role_mapping.yml"
          unmapped_groups_as_roles: false

```

ldapsearch -h [ldapauth.example.com:389](http://ldapauth.example.com:389) -x -s sub -D "ldapuser@example.com" -W -b "dc=example,dc=com"  
The above command I am getting the output

ldapsearch -h [ldapauth.example.com:389](http://ldapauth.example.com:389) -x -s sub -D "dn=ldapuser,dc=example,dc=com" -W -b "dc=example,dc=com"  
ldap\_bind: Invalid credentials (49)

On DEBUG I am not getting any output when I try to use authenticate\_api but getting following output on TRACE logs

```auto
[2019-09-16T14:02:23,218][TRACE][o.e.x.s.a.l.s.LdapUtils] [coordinator-only] LDAP Search SearchRequest(baseDN='dc=example,dc=com', scope=SUB, deref=NEVER, sizeLimit=0, timeLimit=5, filter='(cn=npc0010072)', attrs={1.1}) => SearchResult(resultCode=0 (success), messageID=2, entriesReturned=0, referencesReturned=0) ([])
[2019-09-16T14:02:23,268][TRACE][o.e.x.s.a.l.s.LdapUtils] [coordinator-only] LDAP Search SearchRequest(baseDN='dc=example,dc=com', scope=SUB, deref=NEVER, sizeLimit=0, timeLimit=5, filter='(cn=npc0010072)', attrs={1.1}) => SearchResult(resultCode=0 (success), messageID=2, entriesReturned=0, referencesReturned=0) ([])
[2019-09-16T14:02:23,363][TRACE][o.e.x.s.a.l.s.LdapUtils] [coordinator-only] LDAP referred elsewhere SearchRequest(baseDN='dc=example,dc=com', scope=SUB, deref=NEVER, sizeLimit=0, timeLimit=5, filter='(cn=npc0010072)', attrs={1.1}) => [ldap://example.COM/CN=Schema,CN=Configuration,DC=example,DC=COM]
[2019-09-16T14:02:23,482][TRACE][o.e.x.s.a.l.s.LdapUtils] [coordinator-only] LDAP Search SearchRequest(baseDN='dc=example,dc=com', scope=SUB, deref=NEVER, sizeLimit=0, timeLimit=5, filter='(cn=npc0010072)', attrs={1.1}) => SearchResult(resultCode=0 (success), messageID=2, entriesReturned=0, referencesReturned=0) ([])

```

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [September 16, 2019, 2:31pm UTC](https://discuss.elastic.co/t/how-to-validate-ldap-authenticaion-on-elasticsearch/199611/2 "2019-09-16T14:31:59Z")

</div>

> [@Nikhil\_Pillai](#):
>
> ldapsearch -h [ldapauth.example.com:389](http://ldapauth.example.com:389) -x -s sub -D "[ldapuser@example.com](mailto:ldapuser@example.com)" -W -b "dc=example,dc=com"  
> The above command I am getting the output
> 
> ldapsearch -h [ldapauth.example.com:389](http://ldapauth.example.com:389) -x -s sub -D "dn=ldapuser,dc=example,dc=com" -W -b "dc=example,dc=com"  
> ldap\_bind: Invalid credentials (49)

This is unrelated to Elasticsearch. You seem to have the wrong password for your Bind user (`dn=ldapuser,dc=example,dc=com` ) user. If you don't have the correct credentials for tit this is never going to work,

Without you having the credentials, there is no reason to keep troubleshooting your Elasticserach configuration. Once you figure out what the credentials for the bind\_dn user should be, some more questions:

- Did you set `secure_bind_password` in the elasticearch keystore, as we describe in the documentation ?
- Is this an Active Directory ? If so , why don't you use our Active Directory realm ?
- How are you attempting to authenticate in Elasticsearch or Kibana , what are you passing as a username ? Is that username the CN of one of your users in LDAP as your configuration implies? `(CN={0})`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2019, 2:32pm UTC](https://discuss.elastic.co/t/how-to-validate-ldap-authenticaion-on-elasticsearch/199611/3 "2019-10-14T14:32:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.