# LDAP User Authentication fails with invalid DN error

**URL:** <https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605>\
**Category:** Elasticsearch\
**Created:** [March 22, 2017, 3:19pm UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605 "2017-03-22T15:19:24Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![koladoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koladoo/32/16603_2.png) [@koladoo](https://discuss.elastic.co/u/koladoo)\
**Post date:** [March 22, 2017, 3:19pm UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/1 "2017-03-22T15:19:24Z")

</div>

Hi all,

I am currently trying to setup LDAP user authentication. I added the configuration below to elasticsearch.yml file:

```
xpack:
  security:
    audit:
      enabled: true
    authc:
      realms:
        ldap1:
         type: ldap
         order: 0
         url: "ldap://ldap.starling.lan:389"
         bind_dn: "cn=esuser,dn=starling,dn=lan"
         bind_password: "cloud"
         user_search:
           base_dn: "dc=starling,dc=lan"
           attribute: CN
         user_group_attribute: memberOf
         files:
           role_mapping: "/etc/elasticsearch/x-pack/role_mapping.yml"

        native:
         type: native
         order: 1

        file:
         type: file
         order: 2

```

I also have role mapping file configured like this:

user:

- "cn=user1,dc=starling,dc=lan"
- "cn=user2,dc=starling,dc=lan"
- "cn=user3,dc=starling,dc=lan"
- "cn=user4,dc=starling,dc=lan"

But I am not able to authenticate with any of the users, I get this error message in elasticsearch.log

[2017-03-22T15:52:52,218][WARN][o.e.x.s.a.l.LdapRealm] [8cLTrtp] authentication failed for user [user2]: invalid DN  
cause: com.unboundid.ldap.sdk.LDAPBindException: invalid DN

Please help, I've been on this allday but I have not been able to resolve the problem, I have further deleted all my ACLs on the LDAP server but its still not working.

Thanks

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [March 22, 2017, 3:41pm UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/2 "2017-03-22T15:41:19Z")

</div>

Can you turn up the log level to DEBUG and post the full stacktrace?

---

<div class="post-metadata">

**Author:** ![koladoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koladoo/32/16603_2.png) [@koladoo](https://discuss.elastic.co/u/koladoo)\
**Post date:** [March 22, 2017, 4:27pm UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/3 "2017-03-22T16:27:59Z")

</div>

Thank you for your response, I tried to turn this on, using the cluster settings API with this curl command but it returns empty reply from server

```
curl --user elastic:changeme -XPUT 'localhost:9200/_cluster/settings?pretty' -H 'Content-Type: application/json' -d'
> {
> "transient" : {
> "logger.discovery" : "DEBUG"
> }
> }'
curl: (52) Empty reply from server
```

---

<div class="post-metadata">

**Author:** ![koladoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koladoo/32/16603_2.png) [@koladoo](https://discuss.elastic.co/u/koladoo)\
**Post date:** [March 22, 2017, 5:16pm UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/4 "2017-03-22T17:16:53Z")

</div>

Thank you, I got a way around it, Please see below the logs, when I tried authenticating with an ldap user "myself2", which I have in the role mapping file too:

```
[2017-03-22T17:56:43,201][DEBUG][o.e.x.s.a.l.LdapRealm] [8cLTrtp] authentication failed for user [myself2]
com.unboundid.ldap.sdk.LDAPSearchException: invalid DN
        at com.unboundid.ldap.sdk.AbstractConnectionPool.searchForEntry(AbstractConnectionPool.java:2380) ~[unboundid-ldapsdk-3.2.0.jar:3.2.0]
        at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils.searchForEntry(LdapUtils.java:93) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.LdapUserSearchSessionFactory.findUser(LdapUserSearchSessionFactory.java:203) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.LdapUserSearchSessionFactory.getSessionWithPool(LdapUserSearchSessionFactory.java:140) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.LdapUserSearchSessionFactory.getSession(LdapUserSearchSessionFactory.java:133) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.support.SessionFactory.session(SessionFactory.java:96) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.support.AbstractLdapRealm.doAuthenticate(AbstractLdapRealm.java:57) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.support.CachingUsernamePasswordRealm.authenticate(CachingUsernamePasswordRealm.java:97) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.authenticateToken(AuthenticationService.java:316) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.consumeToken(AuthenticationService.java:251) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$extractToken$6(AuthenticationService.java:226) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.extractToken(AuthenticationService.java:234) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$authenticateAsync$0(AuthenticationService.java:182) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$lookForExistingAuthentication$2(AuthenticationService.java:199) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lookForExistingAuthentication(AuthenticationService.java:211) [x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.authenticateAsync(AuthenticationService.java:178) [x-pack-5.1.2.jar:5.1.2]
 at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.access$000(AuthenticationService.java:140) [x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService.authenticate(AuthenticationService.java:95) [x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.rest.SecurityRestFilter.process(SecurityRestFilter.java:90) [x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:310) [elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:203) [elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.http.HttpServer.dispatchRequest(HttpServer.java:113) [elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.http.netty4.Netty4HttpServerTransport.dispatchRequest(Netty4HttpServerTransport.java:507) [transport-netty4-5.1.2.jar:5.1.2]
        at org.elasticsearch.http.netty4.Netty4HttpRequestHandler.channelRead0(Netty4HttpRequestHandler.java:69) [transport-netty4-5.1.2.jar:5.1.2]
        at io.netty.channel.SimpleChannelInboundHandler.channelRead(SimpleChannelInboundHandler.java:105) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:373) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:351) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at org.elasticsearch.http.netty4.pipelining.HttpPipeliningHandler.channelRead(HttpPipeliningHandler.java:66) [transport-netty4-5.1.2.jar:5.1.2]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:373) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:351) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102) [netty-codec-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:373) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:351) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102) [netty-codec-4.1.6.Final.jar:4.1.6.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:373) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:351) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:293) [netty-codec-4.1.6.Final.jar:4.1.6.Final]
```

---

<div class="post-metadata">

**Author:** ![koladoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koladoo/32/16603_2.png) [@koladoo](https://discuss.elastic.co/u/koladoo)\
**Post date:** [March 22, 2017, 5:19pm UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/5 "2017-03-22T17:19:23Z")

</div>

The other half of the log:

```
 at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:267) [netty-codec-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:373) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:351) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:373) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:351) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1069) [netty-handler-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:902) [netty-handler-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:411) [netty-codec-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:248) [netty-codec-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:373) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:351) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:373) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
    at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:129) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:651) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:536) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:490) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:450) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
            at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:873) [netty-common-4.1.6.Final.jar:4.1.6.Final]
            at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121]
    Caused by: com.unboundid.ldap.sdk.LDAPBindException: invalid DN
            at com.unboundid.ldap.sdk.LDAPConnectionPool.createConnection(LDAPConnectionPool.java:1289) ~[?:?]
            at com.unboundid.ldap.sdk.LDAPConnectionPool.createConnection(LDAPConnectionPool.java:1178) ~[?:?]
            at com.unboundid.ldap.sdk.LDAPConnectionPool.getConnection(LDAPConnectionPool.java:1706) ~[?:?]
            at com.unboundid.ldap.sdk.AbstractConnectionPool.searchForEntry(AbstractConnectionPool.java:2375) ~[?:?]
            ... 66 more
    [2017-03-22T17:56:43,204][DEBUG][o.e.x.s.a.e.NativeRealm] [8cLTrtp] user not found in cache, proceeding with normal authentication
    [2017-03-22T17:56:43,206][DEBUG][o.e.x.s.a.f.FileRealm] [8cLTrtp] user not found in cache, proceeding with normal authentication
    [2017-03-22T17:56:43,210][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:43,277][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:43,279][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:43,288][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:43,301][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:43,304][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:43,310][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:43,314][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:43,435][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:45,752][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:45,792][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:45,796][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:45,804][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:45,825][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:45,829][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]
    [2017-03-22T17:56:45,838][DEBUG][o.e.x.s.a.e.ReservedRealm] [8cLTrtp] authenticated user [kibana], with roles [[kibana]]

```

Thank you.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 22, 2017, 11:53pm UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/6 "2017-03-22T23:53:01Z")

</div>

Based on your stacktrace it looks like you're on a relatively old version of Elasticsearch (perhaps 5.1?)  
While it is unlikely to be the cause of your problem, I would encourage you to look at upgrading to 5.2.2 as we have made a number of improvements to the security code in general, and LDAP specifically.

From the error message, it the problem appears to be your `bind_dn`  
Are you sure that's correct - I think those `dn=` ought to be `dc=`.  
You probably mean for it to be

```
 bind_dn: "cn=esuser,dc=starling,dc=lan"
```

---

<div class="post-metadata">

**Author:** ![koladoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koladoo/32/16603_2.png) [@koladoo](https://discuss.elastic.co/u/koladoo)\
**Post date:** [March 23, 2017, 4:54am UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/7 "2017-03-23T04:54:36Z")

</div>

Thank you for your response, yes we are currently running on 5.1.2, and will consider upgrading but I will like to get LDAP working with our current version. Thanks for pointing the error out, I have made the corrections but I still get the invalid credentials error but the credentials are actually valid and clients can login with those credentials. I tried using the user DN template mode too and I keep getting thesame invalid credentials error. Please see the stack trace below:

```
[2017-03-23T05:40:55,312][DEBUG][o.e.x.s.a.l.LdapRealm] [8cLTrtp] authentication failed for user [myself2]
com.unboundid.ldap.sdk.LDAPSearchException: invalid credentials
        at com.unboundid.ldap.sdk.AbstractConnectionPool.searchForEntry(AbstractConnectionPool.java:2380) ~[unboundid-ldapsdk-3.2.0.jar:3.2.0]
        at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils.searchForEntry(LdapUtils.java:93) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.LdapUserSearchSessionFactory.findUser(LdapUserSearchSessionFactory.java:203) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.LdapUserSearchSessionFactory.getSessionWithPool(LdapUserSearchSessionFactory.java:140) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.LdapUserSearchSessionFactory.getSession(LdapUserSearchSessionFactory.java:133) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.support.SessionFactory.session(SessionFactory.java:96) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.ldap.support.AbstractLdapRealm.doAuthenticate(AbstractLdapRealm.java:57) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.support.CachingUsernamePasswordRealm.authenticate(CachingUsernamePasswordRealm.java:97) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.authenticateToken(AuthenticationService.java:316) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.consumeToken(AuthenticationService.java:251) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$extractToken$6(AuthenticationService.java:226) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.extractToken(AuthenticationService.java:234) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$authenticateAsync$0(AuthenticationService.java:182) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$lookForExistingAuthentication$2(AuthenticationService.java:199) ~[x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lookForExistingAuthentication(AuthenticationService.java:211) [x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.authenticateAsync(AuthenticationService.java:178) [x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.access$000(AuthenticationService.java:140) [x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.authc.AuthenticationService.authenticate(AuthenticationService.java:95) [x-pack-5.1.2.jar:5.1.2]
        at org.elasticsearch.xpack.security.rest.SecurityRestFilter.process(SecurityRestFilter.java:90) [x-pack-5.1.2.jar:5.1.2]
-
-
-
 at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:373) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:129) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:651) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:536) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:490) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:450) [netty-transport-4.1.6.Final.jar:4.1.6.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:873) [netty-common-4.1.6.Final.jar:4.1.6.Final]
        at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121]
Caused by: com.unboundid.ldap.sdk.LDAPBindException: invalid credentials
        at com.unboundid.ldap.sdk.LDAPConnectionPool.createConnection(LDAPConnectionPool.java:1289) ~[?:?]
        at com.unboundid.ldap.sdk.LDAPConnectionPool.createConnection(LDAPConnectionPool.java:1178) ~[?:?]
        at com.unboundid.ldap.sdk.LDAPConnectionPool.getConnection(LDAPConnectionPool.java:1706) ~[?:?]
        at com.unboundid.ldap.sdk.AbstractConnectionPool.searchForEntry(AbstractConnectionPool.java:2375) ~[?:?]
        ... 66 more
```

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 23, 2017, 4:58am UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/8 "2017-03-23T04:58:38Z")

</div>

Based on where that error is occurring, it looks like your `bind_password` is the problem. Double check that.

Or alternatively your `bind_dn` is still incorrect (though no longer strictly invalid).

---

<div class="post-metadata">

**Author:** ![koladoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koladoo/32/16603_2.png) [@koladoo](https://discuss.elastic.co/u/koladoo)\
**Post date:** [March 23, 2017, 5:39am UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/9 "2017-03-23T05:39:05Z")

</div>

Thanks, the bind\_password is correct, ssh from the elasticsearch host to the ldap server and other ldap clients works:  
[user@ES-server~]$ ssh myself@ldap.starling.lan  
myself@ldap.starling.lan's password:  
Last login: Thu Mar 23 06:17:06 2017 from 10.197.138.253  
[myself@server-ldapandkerb~]$

I have also tried to write the bind\_dn in several possible formats but I still get thesame error, I have annonymous access setup on the ldap server too but when I try to connect without the bind\_dn, I still get the authentication failed error:  
[2017-03-23T06:32:09,320][DEBUG][o.e.x.s.a.l.LdapRealm] [8cLTrtp] authentication failed for user [esuser]  
com.unboundid.ldap.sdk.LDAPSearchException: size limit exceeded  
at com.unboundid.ldap.sdk.LDAPConnection.search(LDAPConnection.java:3650) ~[unboundid-ldapsdk-3.2.0.jar:3.2.0]  
at com.unboundid.ldap.sdk.LDAPConnection.searchForEntry(LDAPConnection.java:4012) ~[unboundid-ldapsdk-3.2.0.jar:3.2.0]  
at com.unboundid.ldap.sdk.AbstractConnectionPool.searchForEntry(AbstractConnectionPool.java:2385) ~[unboundid-ldapsdk-3.2.0.jar:3.2.0]

Please have you got any ideas of what else could cause this error ?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 23, 2017, 5:58am UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/10 "2017-03-23T05:58:12Z")

</div>

> [@](#):
>
> Thanks, the bind\_password is correct, ssh from the elasticsearch host to the ldap server and other ldap clients works:
> 
> ```auto
> [user@ES-server~]$ ssh myself@ldap.starling.lan
> 
> ```

That test isn't really showing much - you're testing ssh as `myself`, but your bind\_dn is `esuser`. How are those 2 users related?

Can you verify a pure LDAP connection using the bind DN and password from your config.  
Something like:

```bash
ldapsearch -x -H "ldap://ldap.starling.lan:389" -w "cloud" -D "cn=esuser,dc=starling,dc=lan" -b "dc=starling,dc=lan" "cn=esuser"

```

---

<div class="post-metadata">

**Author:** ![koladoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koladoo/32/16603_2.png) [@koladoo](https://discuss.elastic.co/u/koladoo)\
**Post date:** [March 23, 2017, 8:25am UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/11 "2017-03-23T08:25:18Z")

</div>

Thank you; `esuser` and `myself` are independent, but I am also able to ssh with `esuser`  
`user@ES-server~]$ ssh esuser@ldap.starling.lan`  
`esuser@ldap.starling.lan's password:`  
`[esuser@server-ldapandkerb~]$`

Also trying an ldap search with esuser as suggested, returns Invalid credentials error as below:  
`ldapsearch -x -H "ldap://ldap.starling.lan:389" -w "cloud" -D "cn=esuser,dc=starling,dc=lan" -b "dc=starling,dc=lan" "cn=esuser"`  
`ldap_bind: Invalid credentials (49)`

But a anonymous ldap search is successful:  
`ldapsearch -x -H "ldap://ldap.starling.lan:389" -b "dc=starling,dc=lan"`

I am also able to search with the cn Manager's credentials like below:  
`ldapsearch -x -H "ldap://ldap.starling.lan:389" -w "abcdef" -D "cn=Manager,dc=starling,dc=lan" -b "dc=starling,dc=lan"`

I tried to modify the `bind_dn` in the elasticsearch.xml config to Manager and I modified the bind\_password too as below:  
`bind_dn: "cn=Manager,dc=starling,dc=lan" bind_password: "abcdef"`

but I still get this error in the log when I try to login as user `myself` which exists in my ldap database and the elasticsearch role mapping file,

`[2017-03-23T09:22:57,036][DEBUG][o.e.x.s.a.l.LdapRealm] [8cLTrtp] authentication failed for user [myself] com.unboundid.ldap.sdk.LDAPSearchException: size limit exceeded at com.unboundid.ldap.sdk.LDAPConnection.search(LDAPConnection.java:3650) ~[unboundid-ldapsdk-3.2.0.jar:3.2.0] at com.unboundid.ldap.sdk.LDAPConnection.searchForEntry(LDAPConnection.java:4012) ~[unboundid-ldapsdk-3.2.0.jar:3.2.0] at com.unboundid.ldap.sdk.AbstractConnectionPool.searchForEntry(AbstractConnectionPool.java:2385) ~[unboundid-ldapsdk-3.2.0.jar:3.2.0]`

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 23, 2017, 9:49am UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/12 "2017-03-23T09:49:44Z")

</div>

> [@koladoo](#):
>
> size limit exceeded

This is an error from your LDAP server. It indicates that the search found too many results. _Either_ it found more results than the server was configured to allow, or it found more results than the request is willing to accept.

In this case the most likely explanation is that you have more than 1 user with a `cn` of "myself".

How many results do you get when you run

```auto
ldapsearch -x -H "ldap://ldap.starling.lan:389" -b "dc=starling,dc=lan" "cn=myself"

```

---

<div class="post-metadata">

**Author:** ![koladoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koladoo/32/16603_2.png) [@koladoo](https://discuss.elastic.co/u/koladoo)\
**Post date:** [March 23, 2017, 10:15am UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/13 "2017-03-23T10:15:11Z")

</div>

Thanks, please see the search result for myself

```
[cloud-user@kola-server-ldapandkerberos-environment-kerbldap-server-6e4c8 ~]$ ldapsearch -x -H "ldap://ldap.starling.lan:389" -b "dc=starling,dc=lan" "cn=myself"
# extended LDIF
#

# numResponses: 3
# numEntries: 2

```

I only created the one myself user and migrated the user `/etc/passwd` and`/etc/group` to the LDAP database using the `migrate_passwd.pl` and `migrate_group.pl` perl scripts respectively. However, I've been able to resolve it by creating new LDAP users manualy. Thanks once again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2017, 10:15am UTC](https://discuss.elastic.co/t/ldap-user-authentication-fails-with-invalid-dn-error/79605/14 "2017-04-20T10:15:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.