# Issues Configuring LDAP Authentication

**URL:** <https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819>\
**Category:** Search Guard\
**Created:** [May 4, 2020, 6:25pm UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819 "2020-05-04T18:25:57Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Doug\_Renze](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/doug_renze/32/720_2.png) [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\
**Post date:** [May 4, 2020, 6:25pm UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/1 "2020-05-04T18:25:58Z")

</div>

I’m attempting to configure LDAP authentication in Kibana. I’ve loaded the attached `sg_config.yml` into Elasticsearch. However, when I attempt to login, I get the following error after clicking “Login”:

```auto
{"statusCode":403,"error":"Forbidden","message":"no permissions for [indices:data/read/search] and User [name=CN=username,OU=users,DC=example,DC=com, backend_roles=[], requestedTenant=null]: [security_exception] no permissions for [indices:data/read/search] and User [name=CN=username,OU=users,DC=example,DC=com, backend_roles=[], requestedTenant=null]"}

```

This would suggest to me that authentication is working, but authorization is not. However when I look in the GUI to check the status of LDAP authentication, it states that it’s Disabled (see screenshot).

Attached are screenshots of the “LDAP Disabled” message, `sg_config.yml`, and `kibana.yml`.

I’m using Elasticsearch/Kibana 7.6.2, with the corresponding version of Search Guard.

## Edit

I should also note that we are using nested AD groups for authentication (i.e., we search on group-1, but users are actually members of group-2, group-3, group-4, which are in turn members of group-1).

 ![LDAP Auth Disabled Screenshot](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/68ac05c6cc76e3a01e6021362e6799b960acd237.png) [kibana.yml](https://forum.search-guard.com/uploads/short-url/96Sdl1Kl2tR4BhVSvwGApdsPFZS.yml) (1.6 KB) [sg\_config.yml](https://forum.search-guard.com/uploads/short-url/ajOSqSpTWKdghOA4rt8eP8S6eA3.yml) (6.8 KB)

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [May 5, 2020, 7:10am UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/2 "2020-05-05T07:10:52Z")

</div>

I see you have the LDAP module disabled. Enable it like this

**sg\_config.yml**

```auto
authc:
  ldap:
    enabled: true

```

```auto
authz:
  ldap:
    enabled: true

```

See the docs to find out more about [all available LDAP authc and authz options](https://docs.search-guard.com/latest/active-directory-ldap-connection#active-directory-and-ldap).

Also, don’t change **ldap** module name in sg\_config.yml. There is [a bug that prevents rendering the LDAP module information in the UI if the name was changed](https://forum.search-guard.com/t/viewing-auth-backend-configuration/1787). The bug will be fixed in the next release.

---

<div class="post-metadata">

**Author:** ![Doug\_Renze](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/doug_renze/32/720_2.png) [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\
**Post date:** [May 5, 2020, 1:14pm UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/3 "2020-05-05T13:14:44Z")

</div>

> [@srgbnd](#):
>
> **sg\_config.yml**
> 
> ```auto
> authc:
> ldap:
> enabled: true
> 
> ```
> 
> ```auto
> authz:
> ldap:
> enabled: true
> 
> ```

Updated as shown above, now I receive the following error when loading `sg_config.yml`:

```auto
ERR: Seems /tmp/sgadmin/sgconfig/sg_config.yml is not in SG 7 format: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "enabled" (class com.floragunn.searchguard.sgconf.impl.v7.ConfigV7$AuthcDomain), not marked as ignorable (6 known properties: "http_enabled", "transport_enabled", "http_authenticator", "authentication_backend", "order", "description"])

```

Additionally, just as a note - naming the ldap module in authz `roles_from_my_ldap` is how it’s shown in the sample `sg_config.yml` file included with Search Guard (see below) - this should probably be updated.  
Additionally, when I change the `authz.roles_from_myldap` to `authz.ldap` as shown in the instructions, **that’s** when it fails to render for me.

![LDAP Missing](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/cabff46fe4190a66cb44e7a6632cccb94cbdbcb8.png)

Sample `sg_config.yml`:

```yaml
roles_from_myldap:
  description: "Authorize via LDAP or Active Directory"
  http_enabled: false
  transport_enabled: false
  ...

```

---

<div class="post-metadata">

**Author:** ![Doug\_Renze](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/doug_renze/32/720_2.png) [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\
**Post date:** [May 5, 2020, 4:31pm UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/4 "2020-05-05T16:31:12Z")

</div>

> [@srgbnd](#):
>
> Also, don’t change **ldap** module name in sg\_config.yml. There is [a bug that prevents rendering the LDAP module information in the UI if the name was changed](https://forum.search-guard.com/t/viewing-auth-backend-configuration/1787). The bug will be fixed in the next release.

…also, is this issue resolved in 41.0.0, which was announced today? I’m not seeing it in the changelogs.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [May 6, 2020, 11:53am UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/5 "2020-05-06T11:53:08Z")

</div>

Can you send all Elasticsearch log? Restart it and record all log.

I look at your sg\_config.yml and wonder, are you really running LDAP on [example.com](http://example.com)? Maybe you did a typo. Use your real LDAP domain.

```auto
  authc
    ...
              hosts:
                - ldap.example.com:636
              bind_dn: CN=ldap_user,OU=Service Accounts,DC=example,DC=com
              password: changeme
              users:
                example:
                  base: 'OU=users,DC=example,DC=com'

```

```auto
  authz
    ...
              hosts:
                - ldap.example.com:636
              bind_dn: CN=ldap_user,OU=Service Accounts,DC=example,DC=com
              password: changeme
              roles:
                example:
                  base: 'OU=Elastic Stack,OU=groups,DC=example,DC=com'
              ...
              users:
                example:
                  base: 'OU=users,DC=example,DC=com'

```

Also, you need to configure `userbase`, `userbase` and maybe `username_attribute`. Read this doc [LDAP Authentication | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/active-directory-ldap-authentication) to find more.

> Unrecognized field “enabled”

I was wrong. The `enabled` option was deprecated some time ago but the docs have not been updated. The docs will be fixed soon.

> Also, don’t change **ldap** module name in sg\_config.yml …  
> is this issue resolved in 41.0.0 …?

The plan is to resolve this issue in the next release. The ETA is approximately one month.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [May 6, 2020, 1:31pm UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/6 "2020-05-06T13:31:00Z")

</div>

Also, the following blog posts can be useful:

> **[Elasticsearch LDAP authentication | OpenLDAP setup | Search Guard](https://search-guard.com/elasticsearch-ldap-openldap/)**
>
> This article describes how to set up OpenLDAP for Elasticsearch authentication and authorisation in combination with Search Guard.

> **[Elasticsearch LDAP authentication and authorisation | Search Guard](https://search-guard.com/elasticsearch-ldap-authentication-authorisation/)**
>
> How to configure LDAP or Active Directory for Elasticsearch user authentication and authorization by using the Search Guard security plugin.

---

<div class="post-metadata">

**Author:** ![Doug\_Renze](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/doug_renze/32/720_2.png) [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\
**Post date:** [May 6, 2020, 4:22pm UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/7 "2020-05-06T16:22:47Z")

</div>

> [@srgbnd](#):
>
> I was wrong. The `enabled` option was deprecated some time ago but the docs have not been updated. The docs will be fixed soon.

Thanks - glad to know it’s not me.

> [@srgbnd](#):
>
> I look at your sg\_config.yml and wonder, are you really running LDAP on [example.com](http://example.com)? Maybe you did a typo. Use your real LDAP domain.

Don’t worry - I’m not using `example.com`. I’ve sanitized all files for posting

> [@srgbnd](#):
>
> Also, you need to configure `userbase` , `userbase` and maybe `username_attribute` . Read this doc [https://docs.search-guard.com/latest/active-directory-ldap-authentication](https://docs.search-guard.com/latest/active-directory-ldap-authentication) to find more.

According to the documentation, there are two different ways to configure the `userbase` & `rolebase`:

The first is:

> ```
> authc:
> userbase: 'ou=people,dc=example,dc=com'
> authz:
> rolebase: 'ou=groups,dc=example,dc=com'
> 
> ```

The second is:

> ```
> authc:
> users:
> primary-userbase:
> base: 'ou=people,dc=example,dc=com'
> search: '(uid={0})'
> secondary-userbase:
> base: 'ou=otherpeople,dc=example,dc=com'
> search: '(initials={0})'
> tertiary-rolebase: # <-- this is a typo in the documentation
> ...
> 
> authz:
> roles:
> normalroles:
> base: 'ou=groups,dc=example,dc=com'
> search: '(uniqueMember={0})'
> other:
> base: 'ou=othergroups,dc=example,dc=com'
> search: '(owner={0})'
> 
> ```

…which is what I’m using:

```
authc:
  users:
    example:
      base: 'OU=Users,DC=example,DC=com'
      search: '(sAMAccountName={0})'
  ...

authz:
  roles:
    example:
      base: 'ou=Groups,DC=example,DC=com'
      search: '(member={1})'
  ...

```

Is this correct? I’m using this format so that, once I have it working for our primary domain, I can add a secondary domain. Note that, according to [this answer](https://forum.search-guard.com/t/using-multiple-ldap-rolebases/1502/5) on another ticket, the names for userbase/rolebase don’t matter and can be arbitrarily chosen. I did this in a previous (working) configuration, but unfortunately that instance and those config files appear to be lost forever, which is why I’m starting from scratch again.

I’ve also sent you a copy of all Elasticsearch and Kibana logs by PM. Elastic logs are set to DEBUG for Search Guard, and Kibana logs are set to VERBOSE.

Finally - I’ll review the two blog posts you recommend, to see if either of them appear to apply.

Thanks!

## Edit 1

> [@srgbnd](#):
>
> I was wrong. The `enabled` option was deprecated some time ago but the docs have not been updated. The docs will be fixed soon.

An additional question: I observe that `authc.basic_internal_authentication.transport_enabled: true` is set, but I have `authc.ldap.transport_enabled: false` and `authz.roles_from_myldap.transport_enabled: false` set. Should these be `true`? Because I’m still seeing disabled for both LDAP authentication and authorization.

## Edit 2

I set `authc.ldap.transport_enabled: true` and `authz.roles_from_myldap.transport_enabled: true` and the “Disabled” has disappeared from both authentication and authorization, but no change in behavior. I suspect that this setting only impacts whether LDAP accounts can be used on the transport port, is this correct? I wasn’t able to find clarification in the documentation.

---

<div class="post-metadata">

**Author:** ![Doug\_Renze](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/doug_renze/32/720_2.png) [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\
**Post date:** [May 6, 2020, 6:45pm UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/9 "2020-05-06T18:45:59Z")

</div>

OK…mostly resolved. The key ended up being changing `authz.roles_from_myldap.userrolename: disabled` to `userrolename: memberOf`.

At this point, I can use the AD Group Name as a backend role and successfully login. However, this appears to prevent me from setting a group name to having the equivalent permissions of the `admin` and `kibanaserver` back-end roles. I attempted to do this by duplicating the `SG_ALL_ACCESS` role (for admin) and renaming it, but that doesn’t appear to work. I’m opening another question with that, since this one is resolved.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [May 7, 2020, 11:07am UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/10 "2020-05-07T11:07:41Z")

</div>

> [@Doug\_Renze](#):
>
> I set `authc.ldap.transport_enabled: true` and `authz.roles_from_myldap.transport_enabled: true` and the “Disabled” has disappeared from both authentication and authorization, but no change in behavior. I suspect that this setting only impacts whether LDAP accounts can be used on the transport port, is this correct? I wasn’t able to find clarification in the documentation.

The option `.transport_enabled` enables Elasticsearch transport protocol. It is used if a client supports it. Now to have LDAP shown as enabled in the UI you need to set both `transport_enabled` and `http_enabled ` to true.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [May 28, 2020, 11:07am UTC](https://forum.search-guard.com/t/issues-configuring-ldap-authentication/1819/11 "2020-05-28T11:07:48Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.