# Ldap authentication failure in es and kibana **URL:** \ **Category:** Kibana\ **Created:** [January 3, 2018, 1:05pm UTC](https://discuss.elastic.co/t/ldap-authentication-failure-in-es-and-kibana/113922 "2018-01-03T13:05:28Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Hemanth\_Gowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hemanth_gowda/32/23886_2.png) [@Hemanth\_Gowda](https://discuss.elastic.co/u/Hemanth_Gowda)\ **Post date:** [January 3, 2018, 1:05pm UTC](https://discuss.elastic.co/t/ldap-authentication-failure-in-es-and-kibana/113922/1 "2018-01-03T13:05:28Z")
Hi, I am trying to setup LDAP user authentication.I added the below entries in config file. xpack: security: authc: realms: ldap1: type: ldap order: 0 url: "ldap://vm.sol.st:6888" bind\_dn: "cn=tan,ou=accounts,ou=management,o=ed" bind\_password: test user\_search: base\_dn: "ou=subjects,o=ed" attribute: "uid" files: role\_mapping: "role\_mapping.yml" unmapped\_groups\_as\_roles: false When i try login using kibana/es with the ldap users i am getting the below error. [o.e.x.s.a.AuthenticationService] [ldap\_node] Authentication to realm ldap1 failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='8009030C: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 775, v2580', diagnosticMessage='8009030C: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 775, v2580')) Can you please let me know what could be the issue.I have set up a ldap client in my machine and i can able to login using the mentioned bind user credentials. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [January 4, 2018, 3:08pm UTC](https://discuss.elastic.co/t/ldap-authentication-failure-in-es-and-kibana/113922/2 "2018-01-04T15:08:44Z")
Hi Hemanth, It looks like you try to authenticate against an Active Directory, use the relevant realm type and set this up [according to the documentation](https://www.elastic.co/guide/en/x-pack/current/active-directory-realm.html) ---
**Author:** ![Hemanth\_Gowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hemanth_gowda/32/23886_2.png) [@Hemanth\_Gowda](https://discuss.elastic.co/u/Hemanth_Gowda)\ **Post date:** [January 4, 2018, 3:32pm UTC](https://discuss.elastic.co/t/ldap-authentication-failure-in-es-and-kibana/113922/3 "2018-01-04T15:32:38Z")
Hi, Thanks for the reply.I will try that.And by the way may I know how can u confirm that I am trying to authenticate against AD? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [January 4, 2018, 3:49pm UTC](https://discuss.elastic.co/t/ldap-authentication-failure-in-es-and-kibana/113922/4 "2018-01-04T15:49:59Z")
> [@Hemanth\_Gowda](#): > > And by the way may I know how can u confirm that I am trying to authenticate against AD? It was quite obvious from the error message : ` errorMessage='8009030C: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 775, v2580',` ---
**Author:** ![Hemanth\_Gowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hemanth_gowda/32/23886_2.png) [@Hemanth\_Gowda](https://discuss.elastic.co/u/Hemanth_Gowda)\ **Post date:** [January 5, 2018, 5:27am UTC](https://discuss.elastic.co/t/ldap-authentication-failure-in-es-and-kibana/113922/5 "2018-01-05T05:27:37Z")
Hi, I have used the realm settings for AD.Still getting the same error. [o.e.x.s.a.AuthenticationService] [ldap\_node] Authentication to realm active\_directory failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 525, v23f0', diagnosticMessage='80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 525, v23f0')) Regards, Hemanth K ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 5, 2018, 6:43am UTC](https://discuss.elastic.co/t/ldap-authentication-failure-in-es-and-kibana/113922/6 "2018-01-05T06:43:38Z")
An Active Directory error `49` is invalid credentials Without more context it's hard to tell what the real problem is, but it could be any of: - The DN you've put in `bind_dn` is incorrect (doesn't exist in the directory) - The password you've put in `bind_password` is incorrect - The `domain` you're using in your AD configuration is incorrect. - The user name you've entered in the Kibana login box is incorrect. - The user name you've entered in the Kibana login box is in an incorrect format. - The password you've entered in the Kibana login box is incorrect. Working through those: - You said you can use the bind credentials in an LDAP client. That's good. Please triple-check that the values you entered in your elasticsearch config are an exact match for what you're putting in the client. - Check the `domain` value you're using in your config. If you try to login to an AD realm using a simple username like `jsmith`, then X-Pack security will use the configured domain name in order to bind as the user being authenticated - that is it will bind as `jsmith@your.ad.domain`. If the configured domain doesn't match the domain being used for the UPN, then the bind will fail. - Triple check the username and password you're entering in Kibana. These need to match something in AD. - X-Pack security supports usernames in 3 different formats: raw account-name like `jsmith`, a user-principal-name like `jsmith@your.ad.domain` or a NetBIOS (down level) style `AdDomain\\jsmith`. All of those work - _if_ the realm is configured correctly and the correct values are used for your domain. If you provide more details from your logs we may be able to help narrow down the possible causes. ---
**Author:** ![Hemanth\_Gowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hemanth_gowda/32/23886_2.png) [@Hemanth\_Gowda](https://discuss.elastic.co/u/Hemanth_Gowda)\ **Post date:** [January 5, 2018, 9:58am UTC](https://discuss.elastic.co/t/ldap-authentication-failure-in-es-and-kibana/113922/7 "2018-01-05T09:58:49Z")
Thanks for the information.Will check with ldap team if something is wrong in ldap server. Regards, Hemanth K ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 2, 2018, 9:59am UTC](https://discuss.elastic.co/t/ldap-authentication-failure-in-es-and-kibana/113922/8 "2018-02-02T09:59:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.