# LDAP Authentication - throws BASIC REALM 401 error

**URL:** https://discuss.elastic.co/t/ldap-authentication-throws-basic-realm-401-error/111703
**Category:** Elasticsearch
**Created:** [December 14, 2017, 8:03am UTC](https://discuss.elastic.co/t/ldap-authentication-throws-basic-realm-401-error/111703 "2017-12-14T08:03:19Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![vigneshaj](https://avatars.discourse-cdn.com/v4/letter/v/0ea827/32.png) [@vigneshaj](https://discuss.elastic.co/u/vigneshaj)
#### Post date: [December 14, 2017, 8:03am UTC](https://discuss.elastic.co/t/ldap-authentication-throws-basic-realm-401-error/111703/1 "2017-12-14T08:03:19Z")

</div>

Hi Team

I have set the below configuration in elasticsearch.yml for LDAP authentication. Even though there is no basic realm in config, Error returned is from basic security as below.

```auto
CODE

```

security:  
authc:  
realms:  
ldap1:  
type: ldap  
url: "ldap://\*\***.389"  
bind\_dn: "CN=**,OU=Service,OU=Users,OU=USUWD"  
bind\_password: \*\*\*\*\*\*\*\*  
user\_search:  
base\_dn: "DC=rd,DC=net"

```auto
Error

```

{  
"error": {  
"root\_cause": [  
{  
"type": "security\_exception",  
"reason": "missing authentication token for REST request [/\_cat/nodes?v]",  
"header": {  
"WWW-Authenticate": "Basic realm="security" charset="UTF-8""  
}  
}  
],  
"type": "security\_exception",  
"reason": "missing authentication token for REST request [/\_cat/nodes?v]",  
"header": {  
"WWW-Authenticate": "Basic realm="security" charset="UTF-8""  
}  
},  
"status": 401  
}

How do we make hit LDAP realm instead of default basic realm in this case.

---

<div class="post-metadata">

### Author: ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [December 14, 2017, 12:24pm UTC](https://discuss.elastic.co/t/ldap-authentication-throws-basic-realm-401-error/111703/2 "2017-12-14T12:24:13Z")

</div>

Hi,  
It looks like you are missing the

```auto
attribute: <ldap_attribute_here>

```

in your configuration but I'm not sure if you just left it out.

Regarding the situation at hand , the error is

> missing authentication token for REST request

This seems to suggest that you are not passing the user (and password) parameters in your request.

Assuming you are trying to hit `/_cat/nodes?v` try with

`curl -XGET -u <your_user> 'http://localhost:9200/_cat/nodes?v'` and you will be prompted for the ldap password of the that user .

As stated in the [documentation](https://www.elastic.co/guide/en/x-pack/6.1/ldap-realm.html#ldap-settings) the value of the `attribute:` setting above will affect which attribute \<your\_user\> will be matched against in your LDAP ( `cn`, `uid`, etc )

---

<div class="post-metadata">

### Author: ![vigneshaj](https://avatars.discourse-cdn.com/v4/letter/v/0ea827/32.png) [@vigneshaj](https://discuss.elastic.co/u/vigneshaj)
#### Post date: [December 14, 2017, 1:37pm UTC](https://discuss.elastic.co/t/ldap-authentication-throws-basic-realm-401-error/111703/3 "2017-12-14T13:37:00Z")

</div>

Hi

From the xdap documentation, we didn't find any attribute that is mandatory. If we need to provide can you kindly provide us the sample input.

We are actually using the mentioned curl command to hit the elastic search.  
Problem is if we send default username, password i.e elastic and changeme, it works fine.  
But when we try to send ldap based username and password it throws the mentioned error.

Below is the elastic search log :

[authentication\_failed] origin\_address=[127.0.0.1], principal=[username], uri=[/\_cat/nodes?v]

Authentication to realm ldap1 failed - authenticate failed (Caused by LDAPException(resultCode=49 (invalid credentials), errorMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580 ', diagnosticMessage='80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580 '))

---

<div class="post-metadata">

### Author: ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [December 14, 2017, 1:44pm UTC](https://discuss.elastic.co/t/ldap-authentication-throws-basic-realm-401-error/111703/4 "2017-12-14T13:44:58Z")

</div>

The default value for the `attribute` is `uid` and if you want to change that then you should use the `user_search.filter` as stated in the documentation, instead of `user_search.attribute` (which I mistakenly suggested above) since it is deprecated.

I will not be able to help you much further if I don't have a view of how your user objects are stored in your LDAP directory. Can you share an example of a user located under `DC=rd,DC=net` so that I can guide you to change your realm settings ?

---

<div class="post-metadata">

### Author: ![vigneshaj](https://avatars.discourse-cdn.com/v4/letter/v/0ea827/32.png) [@vigneshaj](https://discuss.elastic.co/u/vigneshaj)
#### Post date: [December 14, 2017, 3:17pm UTC](https://discuss.elastic.co/t/ldap-authentication-throws-basic-realm-401-error/111703/5 "2017-12-14T15:17:54Z")

</div>

Hi ikakavas

After setting the attribute, authentication works as expected.  
Thanks for your help.

---

<div class="post-metadata">

### Author: ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [December 18, 2017, 11:31am UTC](https://discuss.elastic.co/t/ldap-authentication-throws-basic-realm-401-error/111703/6 "2017-12-18T11:31:57Z")

</div>

That's great to hear but please note that `user_search.attribute` is deprecated so it will be removed in future versions. In order to future proof your configuration, please made this rather simple change :

Assuming that the attribute is `cn` (replace it with the one you use - if not ) , change

`user_search.attribute: cn`

to

`user_search.filter: (cn={0})`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 15, 2018, 11:32am UTC](https://discuss.elastic.co/t/ldap-authentication-throws-basic-realm-401-error/111703/7 "2018-01-15T11:32:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.