# Local Login and Active Directory Login
**URL:** https://discuss.elastic.co/t/local-login-and-active-directory-login/304844
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [May 16, 2022, 4:25pm UTC](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844 "2022-05-16T16:25:17Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [May 16, 2022, 4:25pm UTC](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844/1 "2022-05-16T16:25:17Z")
I've recently activated gold licensing for our Elasticsearch 7.16.1 instance. I'm trying to implement Active Directory authentication. I've successfully added the needed configuration for Elasticsearch, but when I add an additional basic provider in the Kibana.yml, I get a fatal error that says you can't have more than one basic provider.
Is it possible to have local login accounts as well as AD integrated logins?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [May 17, 2022, 12:31am UTC](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844/2 "2022-05-17T00:31:30Z")
You only need one basic authentication provider in Kibana, it will work for all the password based realms.
Kibana doesn't care which realm checks the user's password.
---
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [May 18, 2022, 4:14pm UTC](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844/3 "2022-05-18T16:14:26Z")
I've got a role mapping setup that matches any user to allow certain accesses. When I try to login with an account that should match that rule, I get a "username or password is incorrect" error. How can I troubleshoot that things are working properly?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [May 19, 2022, 12:16am UTC](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844/4 "2022-05-19T00:16:25Z")
> I get a "username or password is incorrect" error.
If you get that error, then it has nothing to do with role mappings - it means the user cannot authenticate.
Either you do have an incorrect username or password, or your realm is misconfigured and cannot authenticate any users.
You need to check your Elasticsearch logs.
---
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [May 19, 2022, 3:35pm UTC](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844/5 "2022-05-19T15:35:50Z")
doh...I was expecting to find it in Kibana for some weird reason.
So it didn't like my LDAP filter, saying it was invalid.
```auto
(&(objectClass=user)(sAMAccountName=*)(!((UserAccountControl:1.2.840.113556.1.4.803:=2))))
```
When I remove the UserAccountControl part, I get the error `LDAPException(resultCode=4 (size limit exceeded)`. We have approximately 5k user objects, probably about 4k of which would potentially need access. How do I make this work?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [May 20, 2022, 4:43am UTC](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844/6 "2022-05-20T04:43:35Z")
> **[Security settings in Elasticsearch | Elasticsearch Guide \[8.2\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.2/security-settings.html#ref-ldap-settings)**
> `user_search.filter`
> Specifies the filter used to search the directory in attempts to match \>an entry with the username provided by the user. Defaults to (uid={0}). {0} is substituted with the username provided when searching.
You need `{0}` rather than `*` .
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 17, 2022, 4:44am UTC](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844/7 "2022-06-17T04:44:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.