# Multiple base\_dn Values LDAP authentication **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 7, 2018, 9:43pm UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796 "2018-11-07T21:43:49Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![stevenmarrocco](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stevenmarrocco](https://discuss.elastic.co/u/stevenmarrocco)\ **Post date:** [November 7, 2018, 9:43pm UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/1 "2018-11-07T21:43:49Z")
We had an issue regarding ldap authentication not working correctly and not identifying users. To resolve this we had to be more specific when we configured our base DN Old: `DC=Root,DC=COMPANY,DC=com` New: `DC=Child,DC=Root,DC=COMPANY,DC=com` This is fine for now but the issue is that in the future other groups from the Root forest will need to be able to connect to our elastic instance. Is it possible to provide mutiple base\_dn values? for example: ``` DC=Child2,DC=Root,DC=COMPANY,DC=com DC=Child3,DC=Root,DC=COMPANY,DC=com ``` Thank you ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 8, 2018, 3:15am UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/2 "2018-11-08T03:15:27Z")
Can you explain (in more detail) what issues you were running into without your previous setup? We _could_ implement multiple base DNs, but it would be very inefficient as we would need to search each base independently, and in the end it would be not much different than simply configuring multiple realms. If you're going to have multiple `DC=Child*` that you need to search, then the best solution will be to get it working with the `DC=Root` DN, and work through whatever problems you ran into. ---
**Author:** ![stevenmarrocco](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stevenmarrocco](https://discuss.elastic.co/u/stevenmarrocco)\ **Post date:** [November 8, 2018, 2:18pm UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/3 "2018-11-08T14:18:32Z")
Hi Tim, working with the `DC=Root` for some reason will not authenticate any of the children DCs. The error I recieve is that the user is not found in the ldap cache. I read by default sub\_tree searches are performed. So I assumed that it should be fine. On another application I setup ldap using user filters and group filters. Though these filters I applied using: `(&(bjectClass=group(|(distingiushedName=CN=GROUPNAME1,OU=Universal Groups, OU=Accounts, DC=Root,DC=COMPANY,DC=COM)(distingiushedName=CN=GROUPNAME2,OU=Universal Groups, OU=Accounts, DC=Root,DC=COMPANY,DC=COM)` When I provided the same thing user\_search.filters I would get complaints at authentication that ldap would find multiple results. Another thing is with this other application I was able to set a paging limit, this helped with searching. I don't know if elastic offers the same configuration. Thanks ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 9, 2018, 4:35am UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/4 "2018-11-09T04:35:14Z")
If you can provide specifics (by which I mean copy-and-paste your configuration and the exact error messages) then I'm happy to help work through it and get this working, but the description you've provided isn't clear enough to be able to give you any concrete advice. A subtree search is exactly what you want. If you have duplicate users in the tree, then that will be a problem, as we need to know which user to authenticate. We might be able to resolve that with a filter, but I would need to see the exact details. ---
**Author:** ![stevenmarrocco](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stevenmarrocco](https://discuss.elastic.co/u/stevenmarrocco)\ **Post date:** [November 9, 2018, 4:15pm UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/5 "2018-11-09T16:15:54Z")
Hi Tim, for sure, please see my ldap config: ```auto ldap1: type: ldap order: 0 url: "ldap://sai.co.com:3268" bind_dn: "CN=[AD_USER],OU=Service Accounts,OU=Accounts,DC=SAI,DC=CO,DC=com" bind_password: --------- user_search: base_dn: "DC=CHILD,DC=SAI,DC=CO,DC=com" attribute: sAMAccountName group_search: base_dn: "OU=Universal Groups,OU=Accounts,DC=SAI,DC=RBC,DC=com" files: role_mapping: "F:\\apps\\ELK\\elasticsearch\\config\\x-pack\\role_mapping.yml" unmapped_groups_as_roles: false #timeout.tcp_read: 30s #timeout.tcp_connect: 30s #timeout.ldap_search: 30s file1: type: file order: 1 ``` Error message: ```auto user [Stevenmarrocco] not found in cache for realm [ldap1], proceeding with normal authentication ``` ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 9, 2018, 10:00pm UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/6 "2018-11-09T22:00:00Z")
> [@stevenmarrocco](#): > > user [Stevenmarrocco] not found in cache for realm [ldap1], proceeding with normal authentication That's not an error message, it's just perfectly normal debug logging (which is only shown because you've turned on debug logs). What happens in the logs after that? ---
**Author:** ![stevenmarrocco](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stevenmarrocco](https://discuss.elastic.co/u/stevenmarrocco)\ **Post date:** [November 13, 2018, 2:52pm UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/7 "2018-11-13T14:52:18Z")
Hi Tim, Yes I understand that it is normal debug level logging. Sorry, the config provided works as expected. Once we change `base_dn: 'DC=SAI,DC=CO,DC=com` we then see the error provided. The issue is that authentication is not being done on a sub\_tree level and failing to authenticate the user on that realm. The only option i can see right now is create a new ldap realm per sub domain ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 14, 2018, 12:41am UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/8 "2018-11-14T00:41:40Z")
I really want to make this work for you, because it is intended to work, and I'm reasonably confident that we can sort out the problem but ... > [@stevenmarrocco](#): > > Once we change `base_dn: 'DC=SAI,DC=CO,DC=com` we then see the error provided. Unless I'm missing something, you haven't provided an error. The only log message you've posted is a debug message indicating that the user is not cached. That's exactly what you'd expect to see - we cache users after they're authenticated, so if you're unable to authenticate then the cache will never be populated. > [@stevenmarrocco](#): > > The issue is that authentication is not being done on a sub\_tree level and failing to authenticate the user on that realm. The implementation of the LDAP realm most certainly does use sub\_tree searches, so there's something specific to your environment that is causing whatever problem you're running into. I'm happy to help diagnose that if you can show me an actual error message. As a side note, why are you using the `ldap` realm rather than the `active_directory` realm? ---
**Author:** ![stevenmarrocco](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stevenmarrocco](https://discuss.elastic.co/u/stevenmarrocco)\ **Post date:** [November 14, 2018, 1:04am UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/9 "2018-11-14T01:04:28Z")
You're correct. Technically. There isn't an error. We are just unable to authenticate users that are in a sub\_tree domain. We did try using active\_directory realm but ran into issue. The issues being that it was trying to use the auth.username & auth.password to authenticate against the ad collection for querying. Even when we specified another user. Thinking back to this now.. we may have mislead ourselves looking at the `DEBUG` level logging and considering it `ERROR`. I'll try again tomorrow with the active\_directory realm and see if I'm correct. In the meantime, I've created multiple ldap realms for each sub domain (we have 4). Don't know if this is a correct approach. Another question, we have 3 nodes for our elastic cluster. Do each have to have the same configuration (aside from the minor node names/addresses)? Thanks ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 14, 2018, 1:51am UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/10 "2018-11-14T01:51:09Z")
> [@stevenmarrocco](#): > > There isn't an error. We are just unable to authenticate users that are in a sub\_tree domain. If you can provide the logs, I'm happy to work out why that's the case. "It doesn't work" is hard to diagnose (for you, as well as us) but there's a lot of logging available that can show what's going on. > [@stevenmarrocco](#): > > We did try using active\_directory realm but ran into issue. The issues being that it was trying to use the auth.username & auth.password to authenticate against the ad collection for querying. Even when we specified another user. There are specific configurations that are needed for AD to make it work the way you want, but it should be possible to have it work for you (assuming you're on a recent version). > [@stevenmarrocco](#): > > Another question, we have 3 nodes for our elastic cluster. Do each have to have the same configuration (aside from the minor node names/addresses)? Strictly speaking, **No** you don't; but in practice it is better to do so. Elasticsearch only does authentication at the edge, so the node that you connect to (via the Rest API, or Transport client) needs to have the realm configured. For most use cases that means that all nodes need the realm, because it's common to use a rest client with node sniffing / load balancing, and you could connect to any node. ---
**Author:** ![stevenmarrocco](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stevenmarrocco](https://discuss.elastic.co/u/stevenmarrocco)\ **Post date:** [November 14, 2018, 2:32am UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/11 "2018-11-14T02:32:23Z")
> [@TimV](#): > > If you can provide the logs, I'm happy to work out why that's the case. "It doesn't work" is hard to diagnose (for you, as well as us) but there's a lot of logging available that can show what's going on. For sure, i can provide some logs. I can also open a ticket if that will make things work smoother. > [@TimV](#): > > There are specific configurations that are needed for AD to make it work the way you want, but it should be possible to have it work for you (assuming you're on a recent version). We're using 6.2.2 currently. What specific configurations are you referring to? I can maybe look into the prior to my day tomorrow. > [@TimV](#): > > Strictly speaking, **No** you don't; but in practice it is better to do so. > Elasticsearch only does authentication at the edge, so the node that you connect to (via the Rest API, or Transport client) needs to have the realm configured. > For most use cases that means that all nodes need the realm, because it's common to use a rest client with node sniffing / load balancing, and you could connect to any node. Awesome, thank you. There reason why I ask is I'm want to figure out the quickest way of testing my changes, instead of having to go through, make sure each node has the same config and then restart each service. Thanks ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 14, 2018, 4:16am UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/12 "2018-11-14T04:16:17Z")
> [@stevenmarrocco](#): > > I can also open a ticket if that will make things work smoother. It's easier to share confidential details through a ticket, so it may well be smoother. If you mention this thread in your ticket, then your support rep can ping me if they need any addition input. > [@stevenmarrocco](#): > > What specific configurations are you referring to? From memory, it should just work fine if you set `bind_dn` and `bind_password`, and don't disable connection pooling. But there might be some minor detail that I don't remember right now. There's a lot of config options on the `ldap` and `active_directory` realms, and sometimes 2 settings can interact in perculiar ways. ---
**Author:** ![stevenmarrocco](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stevenmarrocco](https://discuss.elastic.co/u/stevenmarrocco)\ **Post date:** [November 14, 2018, 2:28pm UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/13 "2018-11-14T14:28:37Z")
Hey Tim, Going to go ahead and open a ticket and refer to this thread. Tried AD and now I'm getting authentication failed with invalid credentials. I think I'm not enterting the url/domain correctly. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 12, 2018, 2:32pm UTC](https://discuss.elastic.co/t/multiple-base-dn-values-ldap-authentication/155796/14 "2018-12-12T14:32:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.