# Ldap Authorization from certain OU

**URL:** <https://discuss.elastic.co/t/ldap-authorization-from-certain-ou/321404>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [December 16, 2022, 11:29am UTC](https://discuss.elastic.co/t/ldap-authorization-from-certain-ou/321404 "2022-12-16T11:29:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aleksei](https://avatars.discourse-cdn.com/v4/letter/a/7c8e57/32.png) [@Aleksei](https://discuss.elastic.co/u/Aleksei)\
**Post date:** [December 16, 2022, 11:29am UTC](https://discuss.elastic.co/t/ldap-authorization-from-certain-ou/321404/1 "2022-12-16T11:29:45Z")

</div>

Hi all.  
The question is how to properly configure the config for authorization through LDAP so that you can specify certain OU ( Organizational Unit ) from which users can log in ?

As I understood from the article, this setting is needed.  
Through **user\_dn\_templates**

> **[LDAP user authentication | Elasticsearch Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/ldap-realm.html#tls-ldap)**

> xpack:  
> security:  
> authc:  
> realms:  
> ldap:  
> ldap1:  
> order: 0  
> url: "ldaps://ldap.example.com:636"  
> **user\_dn\_templates** :  
> - "cn={0}, ou=users, o=marketing, dc=example, dc=com"  
> - "cn={0}, ou=users, o=engineering, dc=example, dc=com"  
> group\_search:  
> base\_dn: "dc=example,dc=com"  
> files:  
> role\_mapping: "/mnt/elasticsearch/group\_to\_role\_mapping.yml"  
> unmapped\_groups\_as\_roles: false

In my config the full canonical name (OU) in my config.  
But when I try to login via LDAP, the answer comes - wrong password or name

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a1fc9ad6185465147edcfe70fde6d160393d4e71.jpeg)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f03a836a1bab669a5f2447fdfa67859d71ee7fbe.png)

In the **Mapping rules** settings, I also specify the full name of the OU.  
I also tried with different **User field**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/7/973b15236392bf0208a3230417a64eff15494671.png)

But I still get an error while logging in - wrong password or name.  
Password and user are 100% correct.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2023, 11:30am UTC](https://discuss.elastic.co/t/ldap-authorization-from-certain-ou/321404/2 "2023-01-13T11:30:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.