# LDAP auth and groups **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 7, 2015, 2:10pm UTC](https://discuss.elastic.co/t/ldap-auth-and-groups/25045 "2015-07-07T14:10:56Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![keekz](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@keekz](https://discuss.elastic.co/u/keekz)\ **Post date:** [July 7, 2015, 2:10pm UTC](https://discuss.elastic.co/t/ldap-auth-and-groups/25045/1 "2015-07-07T14:10:56Z")
I seem to be having some difficulty with the ldap auth configuration of Shield. I'm able to successfully auth, but Shield appears to be seeing only a subset of LDAP groups available to the user. Here's the Shield config I'm working with so far: ``` shield.authc: realms: esusers: type: esusers order: 0 ldap1: type: ldap order: 1 enabled: true url: 'ldaps://auth.company.com:636' user_dn_templates: - "cn={0},ou=Users,o=company" group_search: base_dn: "o=company" # commenting out the group_search section yields no ldap groups returned. ``` Here's my log snippet. Note: I've not yet set up roles; I need to get the full ldap group list first. ``` [2015-07-07 09:06:58,764][DEBUG][shield.authc.support] [Tailhook] the roles [[]], are mapped from these [ldap] groups [[cn=Test-Grp,ou=Groups,o=company, cn=All,ou=Groups,o=company, cn=lnx,ou=POSIXGroups,o=company]] for realm [ldap/ldap1] [2015-07-07 09:06:58,775][DEBUG][shield.authc.ldap] [Tailhook] authenticated user [myusername], with roles [[]] ``` Shield appears to be seeing only a subset of the total ldap groups assigned to my user with only one group from each subtree. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 7, 2015, 5:38pm UTC](https://discuss.elastic.co/t/ldap-auth-and-groups/25045/2 "2015-07-07T17:38:31Z")
Hi, Could you let me know what version of Shield you are using and what LDAP server you are communicating with? Without `group_search` settings defined, Shield attempts to retrieve the groups from a attribute on the user. With the group search, Shield will search the sub tree of the base dn for entries that have an `objectClass` of `groupOfNames`, `groupOfUniqueNames`, or `group` AND have `uniqueMember` or `member` set to the DN of your user. What are the object classes of the groups you are also expecting to be returned? -Jay ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 7, 2015, 5:59pm UTC](https://discuss.elastic.co/t/ldap-auth-and-groups/25045/3 "2015-07-07T17:59:57Z")
I just noticed that you may be using posixGroups based on your debug log message. Can you try this configuration: ``` shield.authc: realms: esusers: type: esusers order: 0 ldap1: type: ldap order: 1 enabled: true url: 'ldaps://auth.company.com:636' user_dn_templates: - "cn={0},ou=Users,o=company" group_search: base_dn: "o=company" user_attribute: "uid" filter: "(&(objectclass=posixGroup)(memberUid={0}))" ``` The above configuration change will change the search to look for only posixGroups that have the user's uid as a value for memberUid. ---
**Author:** ![keekz](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@keekz](https://discuss.elastic.co/u/keekz)\ **Post date:** [July 7, 2015, 8:29pm UTC](https://discuss.elastic.co/t/ldap-auth-and-groups/25045/4 "2015-07-07T20:29:45Z")
Thanks for the tip! I feel like I'm pretty close, it's just finding the right ldap filter for our setup. We have a mixture of POSIX and non-POSIX groups, so I need a filter that will pull them all. I'm using the latest version of Shield and ES 1.6. We're not using openldap, although it appears to be mostly/fully openldap compatible, and I'm unsure of what version the ldap server is running. It does not seem to permit memberUid as a query, though. For example, this query yields no results: ``` ldapsearch -x -H ldaps://auth.company.com:636 "(&(cn=*)(memberUid=keekz))" ``` This query "works" in that it lists all the groups my user belongs to, however it lists all uniqueMembers of all the groups: ``` ldapsearch -x -H ldaps://auth.company.com:636 "(&(cn=*)(uniqueMember=cn=keekz,ou=Users,o=company))" ``` (snippet of one of the group outputs from the above query) ``` # vpn, Groups, company dn: cn=vpn,ou=Groups,o=company objectClass: groupOfNames objectClass: Top objectClass: posixGroup uniqueMember: cn=usera,ou=Users,o=company uniqueMember: cn=userb,ou=Users,o=company uniqueMember: cn=userc,ou=Users,o=company uniqueMember: cn=userd,ou=Users,o=company uniqueMember: cn=keekz,ou=Users,o=company cn: vpn ``` This ldapsearch query works to pull the groups for my user: ``` ldapsearch -xLLL -H ldaps://auth.company.com:636/ -b "o=company" "uid=keekz" groupMembership ``` Output: ``` dn: cn=keekz,ou=Users,o=company groupMembership: cn=global,ou=Groups,o=company groupMembership: cn=analytics,ou=Groups,o=company groupMembership: cn=lnx-engineers,ou=POSIXGroups,o=company groupMembership: cn=lnx-ops,ou=POSIXGroups,o=company groupMembership: cn=vpn,ou=Groups,o=company groupMembership: cn=github,ou=Groups,o=company ``` (and many other groups!) I've been stuck on converting this to something that ES is able to use... but I'm so close! =P ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 8, 2015, 12:04pm UTC](https://discuss.elastic.co/t/ldap-auth-and-groups/25045/5 "2015-07-08T12:04:17Z")
So it looks like your ldap supports the attribute `groupMembership` on the user. I think the following configuration should work: ``` shield.authc: realms: esusers: type: esusers order: 0 ldap1: type: ldap order: 1 enabled: true url: 'ldaps://auth.company.com:636' user_dn_templates: - "cn={0},ou=Users,o=company" user_group_attribute: "groupMembership" ``` ---
**Author:** ![keekz](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@keekz](https://discuss.elastic.co/u/keekz)\ **Post date:** [July 8, 2015, 3:55pm UTC](https://discuss.elastic.co/t/ldap-auth-and-groups/25045/6 "2015-07-08T15:55:41Z")
That did the trick! Thanks so much, Jay! I see the user\_group\_attribute setting does not appear in the Shield ldap documentation at [https://www.elastic.co/guide/en/shield/current/ldap.html](https://www.elastic.co/guide/en/shield/current/ldap.html) - hopefully we can get that added (I'm not sure if you work at Elastic and can get that updated). For anyone else who might come across this discussion from a search, here's the working Shield config for our ldap authentication: ``` shield.authc: realms: esusers: type: esusers order: 0 ldap1: type: ldap order: 1 enabled: true url: 'ldaps://auth.company.com:636' user_dn_templates: - "cn={0},ou=Users,o=company" user_group_attribute: "groupMembership" ``` Works great. Thanks again, Jay! ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 8, 2015, 4:13pm UTC](https://discuss.elastic.co/t/ldap-auth-and-groups/25045/7 "2015-07-08T16:13:22Z")
I noticed that it was missing from our documentation also. I've logged an issue and will work on getting it added to the docs. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/ldap-auth-and-groups/25045/8 "2017-07-06T13:48:56Z")