# LDAP authentication fails
**URL:** https://discuss.elastic.co/t/ldap-authentication-fails/163803
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [January 10, 2019, 8:39pm UTC](https://discuss.elastic.co/t/ldap-authentication-fails/163803 "2019-01-10T20:39:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@jguzzetti](https://discuss.elastic.co/u/jguzzetti)
#### Post date: [January 10, 2019, 8:39pm UTC](https://discuss.elastic.co/t/ldap-authentication-fails/163803/1 "2019-01-10T20:39:09Z")
Hi! I'm tryin to conect my Elasticsearch 6.5.4 to my ldap server in my company but i could not login any user in the AD. The only user that i could meke him login is the bind\_dn user, but i get the following error message:
{"message":"action [indices:data/read/search] is unauthorized for user [xxxxxxx]: [security\_exception] action [indices:data/read/search] is unauthorized for user [gitlab\_auth]","statusCode":403,"error":"Forbidden"}
My elasticsearch.yml:
#Security
xpack.security.enabled: true
xpack:
security:
authc:
realms:
ldap1:
type: ldap
order: 0
url: "ldap://172.29.xx.xx:389"
bind\_dn: "CN=xxxxx,OU=XXX XX,OU=XXX XXX,OU=XXX XXX XX,DC=xxxx,DC=xxxx"
user\_search:
base\_dn: "OU=XXX XX,OU=XXX XXX,OU=XXX XXX XX,DC=xxxx,DC=xxxx"
filter: "cn={0}"
group\_search:
base\_dn: "dc=xxxxxxx,dc=xxxx"
unmapped\_groups\_as\_roles: false
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [January 10, 2019, 11:01pm UTC](https://discuss.elastic.co/t/ldap-authentication-fails/163803/2 "2019-01-10T23:01:19Z")
> [@jguzzetti](#):
>
> but i could not login any user in the AD
If you are using AD, then you should use the `active_directory` realm type, rather than `ldap`. It is _possible_ to use ldap for this, but the AD realm handles a variety of AD specific features that you will want.
> [@jguzzetti](#):
>
> {"message":"action [indices:data/read/search] is unauthorized for user [xxxxxxx]: [security\_exception] action [indices:data/read/search] is unauthorized for user [gitlab\_auth]","statusCode":403,"error":"Forbidden"}
This is an authorization (privileges) problem. You need to configure role mapping so that the user has permissions in ES. See: [Mapping users and groups to roles | Elasticsearch Guide [6.5] | Elastic](https://www.elastic.co/guide/en/elastic-stack-overview/6.5/mapping-roles.html)
> [@jguzzetti](#):
>
> i could not login any user
Happy to help diagnose that, but you'll need to provide a clear description of the steps you took and the errors you saw (both logs and API errors)
---
### Author:  [@jguzzetti](https://discuss.elastic.co/u/jguzzetti)
#### Post date: [January 11, 2019, 12:40pm UTC](https://discuss.elastic.co/t/ldap-authentication-fails/163803/3 "2019-01-11T12:40:08Z")
Thanks for your reply. I´ll try to configure de active\_directory realm and i´ll let you know if it works.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 8, 2019, 12:40pm UTC](https://discuss.elastic.co/t/ldap-authentication-fails/163803/4 "2019-02-08T12:40:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.