# LDAP Group members can't login in elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 12, 2022, 3:25pm UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446 "2022-10-12T15:25:06Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Tarah](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@Tarah](https://discuss.elastic.co/u/Tarah)\ **Post date:** [October 12, 2022, 3:25pm UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446/1 "2022-10-12T15:25:06Z")
Hi Elastic Team, I think I'm missing something here. E456 uid can't login to elasticsearch even if it is a member of ou=people,ou=ec,o=world. But when using E123 uid, it is successful. E456 and E123 belongs to the same group btw. elasticsearch.yml ```auto xpack.security.authc.realms.ldap.ldap01: order: 0 url: "ldaps://example.example.com:636" user_dn_templates: - "uid={0},ou=people,ou=ec,o=world" group_search: base_dn: "ou=people,ou=ec,o=world" files: role_mapping: "/etc/elasticsearch/role_mapping.yml" unmapped_groups_as_roles: false ``` role\_mapping.yml ```auto superuser: - "ou=people,ou=ec,o=world" - "uid=E123,ou=people,ou=ec,o=world" ``` Hope someone can help. Thank you! ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [October 14, 2022, 12:22am UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446/2 "2022-10-14T00:22:19Z")
You'll need share more information for any meaningful diagnosis, e.g. what is the exact error, (401 or 403?), server side trace or debug logs for the failure and success scenarios, exact how you entered the username for authenticating and perhaps the [authenticate response](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-authenticate.html) from the successful user. ---
**Author:** ![Tarah](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@Tarah](https://discuss.elastic.co/u/Tarah)\ **Post date:** [October 14, 2022, 7:27am UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446/3 "2022-10-14T07:27:26Z")
Hi Yang\_Wang, I'm getting this error when logging in as E456. But when logging is as E123, I'm directed to kibana web successfully. ![elk](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed879924ec8cb783d3bb2f4ea55a0e67d5d01b23.png) ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [October 14, 2022, 9:09am UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446/4 "2022-10-14T09:09:00Z")
I think this is likely a 403 authorization error. You can try add the E456 user to your role mapping file, e.g.: ```auto superuser: - "ou=people,ou=ec,o=world" - "uid=E123,ou=people,ou=ec,o=world" - "uid=E456,ou=people,ou=ec,o=world" ``` ---
**Author:** ![Tarah](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@Tarah](https://discuss.elastic.co/u/Tarah)\ **Post date:** [October 14, 2022, 9:22am UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446/5 "2022-10-14T09:22:27Z")
Yes, I actually did that and it is working. But what I planned to do is give access to mulitple members not only E123 and E456. So like what I'm trying to do is give access to all members of that LDAP group without manually type all of them in role\_mapping.yml ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [October 14, 2022, 10:40am UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446/6 "2022-10-14T10:40:35Z")
You should check what you get in the [Authenticate API response](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-authenticate.html). The user's ldap groups are listed in the metadata. My guess is that the groups do not match `ou=people,ou=ec,o=world` which is why the entry is not working. ---
**Author:** ![Tarah](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@Tarah](https://discuss.elastic.co/u/Tarah)\ **Post date:** [October 17, 2022, 2:41pm UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446/7 "2022-10-17T14:41:56Z")
Hi Yang Wang, Still stuck. ☹ But here's a new log in elasticsearch. You can see it is auth successful. But still having error like above screenshot. ```auto [2022-10-17T14:23:58,629][DEBUG][o.e.x.s.a.RealmsAuthenticator] [host] Authentication of [E456] using realm [ldap/ldap01] with token [UsernamePasswordToken] was [AuthenticationResult{status=SUCCESS, value=User[username=E456,roles=[],fullName=null,email=null,metadata={ldap_dn=uid=E456,ou=people,ou=ec,o=world, ldap_groups=[]}], message=null, exception=null}] ``` ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [October 17, 2022, 11:39pm UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446/8 "2022-10-17T23:39:41Z")
Yeah the issue is with authorization (role mapping), _not_ authencation. Based on the log message, it is clear that your `E456` user does not have any ldap groups > [@Tarah](#): > > `ldap_groups=[]` Maybe this user does not have permission to perform group search. Or maybe you should search group in higher level, i.e. instead of ```auto group_search: base_dn: "ou=people,ou=ec,o=world" ``` try ```auto group_search: base_dn: "ou=ec,o=world" ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 14, 2022, 11:40pm UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446/9 "2022-11-14T23:40:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.