# Settings from elasticsearch-keystore not loaded

**URL:** https://discuss.elastic.co/t/settings-from-elasticsearch-keystore-not-loaded/133067
**Category:** Elasticsearch
**Created:** [May 24, 2018, 2:42am UTC](https://discuss.elastic.co/t/settings-from-elasticsearch-keystore-not-loaded/133067 "2018-05-24T02:42:06Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![sureshsubramaniyan](https://avatars.discourse-cdn.com/v4/letter/s/a9adbd/32.png) [@sureshsubramaniyan](https://discuss.elastic.co/u/sureshsubramaniyan)
#### Post date: [May 24, 2018, 2:42am UTC](https://discuss.elastic.co/t/settings-from-elasticsearch-keystore-not-loaded/133067/1 "2018-05-24T02:42:06Z")

</div>

I have stored the active directory bind user password in elasticsearch keystore . but password not getting read from the keystore .

elasticsearch.yml settings:

```
xpack:
  security:
    authc:
      realms:
        native1:
           type: native
           order: 0
        ldapad:
           type: active_directory
           order: 1
           domain_name: domain.net
           url: ["ldap://domain1.net:389","ldap://domain2.net:389"]
           load_balance.type: failover
           bind_dn: elkuser.001
           user_search.base_dn: "OU=xxx,OU=xxx,OU=xxx,DC=xxx,DC=xxx,DC=xxx" 

```

keystore :

```
elastic@elkhost[bin] $ ./elasticsearch-keystore list
keystore.seed
xpack.security.authc.realms.ldapad.bind_password
elastic@elkhost[bin] $ 

```

logs:

```
[2018-05-24T02:23:31,564][WARN][o.e.x.s.a.AuthenticationService] [dev-node1] Authentication to realm ldapad failed - authenticate failed (Caused by LDAPException(resultCode=89 (parameter error), errorMessage='Simple bind operations are not allowed to contain a bind DN without a password.', diagnosticMessage='Simple bind operations are not allowed to contain a bind DN without a password.'))
```

---

<div class="post-metadata">

### Author: ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)
#### Post date: [May 24, 2018, 4:18am UTC](https://discuss.elastic.co/t/settings-from-elasticsearch-keystore-not-loaded/133067/2 "2018-05-24T04:18:13Z")

</div>

The elasticsearch keystore cannot be used with any arbitrary settings. Each setting must be specifically configured in the code to look in the keystore. The bind password here has been updated to support keystore, but that has not yet been released [(it will be in 6.3.0](https://www.elastic.co/guide/en/elasticsearch/reference/6.x/configuring-ldap-realm.html#configuring-ldap-realm)). Also note the setting in the keystore has a different name (so there is no ambiguity if it existed in both elasticsearch.yml and the keystore). The keystore setting name has `secure_` prefixed, so `secure_bind_password`.

---

<div class="post-metadata">

### Author: ![sureshsubramaniyan](https://avatars.discourse-cdn.com/v4/letter/s/a9adbd/32.png) [@sureshsubramaniyan](https://discuss.elastic.co/u/sureshsubramaniyan)
#### Post date: [May 29, 2018, 12:34pm UTC](https://discuss.elastic.co/t/settings-from-elasticsearch-keystore-not-loaded/133067/3 "2018-05-29T12:34:29Z")

</div>

@rjernst ,

thanks for your update.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2018, 12:42pm UTC](https://discuss.elastic.co/t/settings-from-elasticsearch-keystore-not-loaded/133067/4 "2018-06-26T12:42:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.