# Unable to Login as Active Directory User per Kibana (but API works)

**URL:** https://discuss.elastic.co/t/unable-to-login-as-active-directory-user-per-kibana-but-api-works/223514
**Category:** Kibana
**Created:** [March 13, 2020, 1:14pm UTC](https://discuss.elastic.co/t/unable-to-login-as-active-directory-user-per-kibana-but-api-works/223514 "2020-03-13T13:14:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ksremo](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@ksremo](https://discuss.elastic.co/u/ksremo)
#### Post date: [March 13, 2020, 1:14pm UTC](https://discuss.elastic.co/t/unable-to-login-as-active-directory-user-per-kibana-but-api-works/223514/1 "2020-03-13T13:14:53Z")

</div>

Unable to Login as Active Directory User per Kibana,  
but Login per curl from kibana node works well, also the role mapping.

How to debug/solve this problem?

KIBANA per WEBINTERFACE:

> ```
> "error" : {
> "root_cause" : [
> {
> "type" : "security_exception",
> "reason" : "unable to authenticate user [aduser] for REST request [/_security/_authenticate?pretty]",
> "header" : {
> "WWW-Authenticate" : [
> "Bearer realm=\"security\"",
> "ApiKey",
> "Basic realm=\"security\" charset=\"UTF-8\""
> ]
> }
> }
> ],
> 
> ```

API per cURL:

> ```
> root@server: /usr/share/kibana/bin # curl --noproxy "*" -k -u aduser:password -X GET "https://<elasticsearchnode>:9200/_security/_authenticate?pretty"
> {
> "username" : "aduser",
> "roles" : [
> "kibana_admin",
> "superuser"
> ],
> "full_name" : null,
> "email" : null,
> "metadata" : {
> "ldap_dn" : "CN=FirstName LastName,OU=OUUnit,OU=Unit,DC=mydomain,DC=local",
> "ldap_groups" : [
> "CN=Users,CN=Builtin,DC=mydomain,DC=local",
> "CN=Domain Users,CN=Users,DC=mydomain,DC=local",
> "CN=groupname,CN=Users,DC=mydomain,DC=local"
> ]
> },
> "enabled" : true,
> "authentication_realm" : {
> "name" : "my_ad",
> "type" : "active_directory"
> },
> "lookup_realm" : {
> "name" : "my_ad",
> "type" : "active_directory"
> }
> }
> 
> ```

---

<div class="post-metadata">

### Author: ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)
#### Post date: [March 13, 2020, 8:51pm UTC](https://discuss.elastic.co/t/unable-to-login-as-active-directory-user-per-kibana-but-api-works/223514/2 "2020-03-13T20:51:01Z")

</div>

Are you using proxy infront of Kibana? Are there any logs ? what does the web console output say? Typically users do pass the token or auth headers via a reverse proxy. Would that work in your case?more information required.

Thanks  
Rashmi

---

<div class="post-metadata">

### Author: ![ksremo](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@ksremo](https://discuss.elastic.co/u/ksremo)
#### Post date: [March 30, 2020, 9:10am UTC](https://discuss.elastic.co/t/unable-to-login-as-active-directory-user-per-kibana-but-api-works/223514/3 "2020-03-30T09:10:20Z")

</div>

we resolved this issue. configuration is correct.

reason was a bad certificate on one cluster member data node.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 27, 2020, 9:10am UTC](https://discuss.elastic.co/t/unable-to-login-as-active-directory-user-per-kibana-but-api-works/223514/4 "2020-04-27T09:10:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.