# SearchGuard + ActiveDirectory give me an exception (WARN)

**URL:** <https://forum.search-guard.com/t/searchguard-activedirectory-give-me-an-exception-warn/507>\
**Category:** Search Guard\
**Created:** [July 5, 2017, 9:17am UTC](https://forum.search-guard.com/t/searchguard-activedirectory-give-me-an-exception-warn/507 "2017-07-05T09:17:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marco\_Costantini](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@Marco\_Costantini](https://forum.search-guard.com/u/Marco_Costantini)\
**Post date:** [July 5, 2017, 9:17am UTC](https://forum.search-guard.com/t/searchguard-activedirectory-give-me-an-exception-warn/507/1 "2017-07-05T09:17:19Z")

</div>

I’m using SearchGuard with ES 5.2.2 mostly successfully. I’m trying to eliminate a warning that appears in the console output.

The warning is:  
`[2017-07-05T10:33:09,020][WARN][o.l.r.SearchReferralHandler] Could not follow referral to ldap://ForestDnsZones.hidden.hidden.local/DC=ForestDnsZones,DC=hidden,DC=hidden,DC=local org.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C0906DC, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db0]; remaining name 'DC=ForestDnsZones,DC=hidden,DC=hidden,DC=local' ... Caused by: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C0906DC, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db0] `

I only get this print out because I’ve used the 5.0.8 version of the enterprise extension (found in another thread here).

Why does this warning occur? To me its strange because the ldap config is, otherwise, working well. Here is my ldap config.  
ldap:

enabled: true

order: 1

```
    http_authenticator:

```

type: basic

challenge: true

authentication\_backend:

# LDAP authentication backend (authenticate users against a LDAP or Active Directory)

type: ldap # NOT FREE FOR COMMERCIAL USE

config:

# enable ldaps

enable\_ssl: false

# enable start tls, enable\_ssl should be false

enable\_start\_tls: false

# send client certificate

enable\_ssl\_client\_auth: false

# verify ldap hostname

verify\_hostnames: true

hosts:

- [10.555.555.555:389](http://10.234.42.7:389/)

bind\_dn: CN=LdapUserReader,OU=Comptes de services,OU=hidden,DC=hidden,DC=hidden,DC=local

password: hidden

userbase: ‘DC=hidden,DC=hidden,DC=local’

# Filter to search for users (currently in the whole subtree beneath userbase)

# {0} is substituted with the username

usersearch: ‘(sAMAccountName={0})’

# Use this attribute from the user as username (if not set then DN is used)

username\_attribute: null

authz:

roles\_from\_myldap:

enabled: true

authorization\_backend:

# LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)

type: ldap # NOT FREE FOR COMMERCIAL USE

config:

# enable ldaps

enable\_ssl: false

# enable start tls, enable\_ssl should be false

enable\_start\_tls: false

# send client certificate

enable\_ssl\_client\_auth: false

# verify ldap hostname

verify\_hostnames: true

hosts:

- [10.555.555.555:389](http://10.234.42.7:389/)

bind\_dn: CN=LdapUserReader,OU=Comptes de services,OU=hidden,DC=hidden,DC=hidden,DC=local

password: hidden

rolebase: ‘ou=Groupes de sécurité,ou=hidden,DC=hidden,DC=hidden,DC=local’

# Filter to search for roles (currently in the whole subtree beneath rolebase)

# {0} is substituted with the DN of the user

# {1} is substituted with the username

# {2} is substituted with an attribute value from user’s directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute

rolesearch: ‘(member={0})’

# Specify the name of the attribute which value should be substituted with {2} above

userroleattribute: null

# Roles as an attribute of the user entry

userrolename: disabled

#userrolename: memberOf

# The attribute in a role entry containing the name of that role, Default is “name”.

# Can also be “dn” to use the full DN as rolename.

rolename: cn

# Resolve nested roles transitive (roles which are members of other roles and so on …)

resolve\_nested\_roles: true

userbase: ‘DC=hidden,DC=hidden,DC=local’

# Filter to search for users (currently in the whole subtree beneath userbase)

# {0} is substituted with the username

usersearch: ‘(sAMAccountName={0})’

# Skip users matching a user name, a wildcard or a regex pattern

#skip\_users:

# - ‘cn=Michael Jackson,ou\*people,o=TEST’

# - ‘/\S\*/’

roles\_from\_another\_ldap:

enabled: false

authorization\_backend:

type: ldap # NOT FREE FOR COMMERCIAL USE

#config goes here …

``

---

<div class="post-metadata">

**Author:** ![Marco\_Costantini](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@Marco\_Costantini](https://forum.search-guard.com/u/Marco_Costantini)\
**Post date:** [July 5, 2017, 9:49am UTC](https://forum.search-guard.com/t/searchguard-activedirectory-give-me-an-exception-warn/507/2 "2017-07-05T09:49:30Z")

</div>

I followed some random internet post’s advice and changed my AD configuration to use port 3268 instead of port 389. This got rid of all the warnings and auth still works great.

Thanks.

M

> **···**
>
> On Wednesday, July 5, 2017 at 11:17:19 AM UTC+2, Marco Costantini wrote:
> 
> > I’m using SearchGuard with ES 5.2.2 mostly successfully. I’m trying to eliminate a warning that appears in the console output.
> > 
> > The warning is:  
> > `[2017-07-05T10:33:09,020][WARN][o.l.r.SearchReferralHandler] Could not follow referral to ldap://ForestDnsZones.hidden.hidden.local/DC=ForestDnsZones,DC=hidden,DC=hidden,DC=local org.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C0906DC, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db0]; remaining name 'DC=ForestDnsZones,DC=hidden,DC=hidden,DC=local' ... Caused by: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C0906DC, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db0] `
> 
> > I only get this print out because I’ve used the 5.0.8 version of the enterprise extension (found in another thread here).
> > 
> > Why does this warning occur? To me its strange because the ldap config is, otherwise, working well. Here is my ldap config.  
> > ldap:
> 
> > enabled: true
> 
> > order: 1
> 
> > ```
> > http_authenticator:
> > 
> > ```
> > 
> > type: basic
> 
> > challenge: true
> 
> > authentication\_backend:
> 
> > # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
> 
> > type: ldap # NOT FREE FOR COMMERCIAL USE
> 
> > config:
> 
> > # enable ldaps
> 
> > enable\_ssl: false
> 
> > # enable start tls, enable\_ssl should be false
> 
> > enable\_start\_tls: false
> 
> > # send client certificate
> 
> > enable\_ssl\_client\_auth: false
> 
> > # verify ldap hostname
> 
> > verify\_hostnames: true
> 
> > hosts:
> 
> > - [10.555.555.555:389](http://10.234.42.7:389/)
> 
> > bind\_dn: CN=LdapUserReader,OU=Comptes de services,OU=hidden,DC=hidden,DC=hidden,DC=local
> 
> > password: hidden
> 
> > userbase: ‘DC=hidden,DC=hidden,DC=local’
> 
> > # Filter to search for users (currently in the whole subtree beneath userbase)
> 
> > # {0} is substituted with the username
> 
> > usersearch: ‘(sAMAccountName={0})’
> 
> > # Use this attribute from the user as username (if not set then DN is used)
> 
> > username\_attribute: null
> 
> > authz:
> 
> > roles\_from\_myldap:
> 
> > enabled: true
> 
> > authorization\_backend:
> 
> > # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
> 
> > type: ldap # NOT FREE FOR COMMERCIAL USE
> 
> > config:
> 
> > # enable ldaps
> 
> > enable\_ssl: false
> 
> > 
> 
> > # enable start tls, enable\_ssl should be false
> 
> > enable\_start\_tls: false
> 
> > # send client certificate
> 
> > enable\_ssl\_client\_auth: false
> 
> > # verify ldap hostname
> 
> > verify\_hostnames: true
> 
> > hosts:
> 
> > - [10.555.555.555:389](http://10.234.42.7:389/)
> 
> > bind\_dn: CN=LdapUserReader,OU=Comptes de services,OU=hidden,DC=hidden,DC=hidden,DC=local
> 
> > password: hidden
> 
> > rolebase: ‘ou=Groupes de sécurité,ou=hidden,DC=hidden,DC=hidden,DC=local’
> 
> > # Filter to search for roles (currently in the whole subtree beneath rolebase)
> 
> > # {0} is substituted with the DN of the user
> 
> > # {1} is substituted with the username
> 
> > # {2} is substituted with an attribute value from user’s directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
> 
> > rolesearch: ‘(member={0})’
> 
> > # Specify the name of the attribute which value should be substituted with {2} above
> 
> > userroleattribute: null
> 
> > # Roles as an attribute of the user entry
> 
> > userrolename: disabled
> 
> > #userrolename: memberOf
> 
> > # The attribute in a role entry containing the name of that role, Default is “name”.
> 
> > # Can also be “dn” to use the full DN as rolename.
> 
> > rolename: cn
> 
> > # Resolve nested roles transitive (roles which are members of other roles and so on …)
> 
> > resolve\_nested\_roles: true
> 
> > userbase: ‘DC=hidden,DC=hidden,DC=local’
> 
> > # Filter to search for users (currently in the whole subtree beneath userbase)
> 
> > # {0} is substituted with the username
> 
> > usersearch: ‘(sAMAccountName={0})’
> 
> > # Skip users matching a user name, a wildcard or a regex pattern
> 
> > #skip\_users:
> 
> > # - ‘cn=Michael Jackson,ou\*people,o=TEST’
> 
> > # - ‘/\S\*/’
> 
> > roles\_from\_another\_ldap:
> 
> > enabled: false
> 
> > authorization\_backend:
> 
> > type: ldap # NOT FREE FOR COMMERCIAL USE
> 
> > #config goes here …
> 
> > 
> 
> > ``

---

<div class="post-metadata">

**Author:** ![Marco\_Costantini](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@Marco\_Costantini](https://forum.search-guard.com/u/Marco_Costantini)\
**Post date:** [July 5, 2017, 9:54am UTC](https://forum.search-guard.com/t/searchguard-activedirectory-give-me-an-exception-warn/507/3 "2017-07-05T09:54:49Z")

</div>

Our AD guy was curious as to why SearchGuard needs to access the GlobalCatalog. I am well out of my league at this point, however, would someone care to elaborate on that subject? I can relay the info to him. Please and thanks,  
Marco.

> **···**
>
> On Wednesday, July 5, 2017 at 11:49:30 AM UTC+2, Marco Costantini wrote:
> 
> > I followed some random internet post’s advice and changed my AD configuration to use port 3268 instead of port 389. This got rid of all the warnings and auth still works great.
> 
> > Thanks.
> 
> > M
> 
> > On Wednesday, July 5, 2017 at 11:17:19 AM UTC+2, Marco Costantini wrote:
> > 
> > > I’m using SearchGuard with ES 5.2.2 mostly successfully. I’m trying to eliminate a warning that appears in the console output.
> > > 
> > > The warning is:  
> > > `[2017-07-05T10:33:09,020][WARN][o.l.r.SearchReferralHandler] Could not follow referral to ldap://ForestDnsZones.hidden.hidden.local/DC=ForestDnsZones,DC=hidden,DC=hidden,DC=local org.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C0906DC, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db0]; remaining name 'DC=ForestDnsZones,DC=hidden,DC=hidden,DC=local' ... Caused by: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C0906DC, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db0] `
> 
> > > I only get this print out because I’ve used the 5.0.8 version of the enterprise extension (found in another thread here).
> > > 
> > > Why does this warning occur? To me its strange because the ldap config is, otherwise, working well. Here is my ldap config.  
> > > ldap:
> 
> > > enabled: true
> 
> > > order: 1
> 
> > > ```
> > > http_authenticator:
> > > 
> > > ```
> > > 
> > > type: basic
> 
> > > challenge: true
> 
> > > authentication\_backend:
> 
> > > # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
> 
> > > type: ldap # NOT FREE FOR COMMERCIAL USE
> 
> > > config:
> 
> > > # enable ldaps
> 
> > > enable\_ssl: false
> 
> > > # enable start tls, enable\_ssl should be false
> 
> > > enable\_start\_tls: false
> 
> > > # send client certificate
> 
> > > enable\_ssl\_client\_auth: false
> 
> > > # verify ldap hostname
> 
> > > verify\_hostnames: true
> 
> > > hosts:
> 
> > > - [10.555.555.555:389](http://10.234.42.7:389/)
> 
> > > bind\_dn: CN=LdapUserReader,OU=Comptes de services,OU=hidden,DC=hidden,DC=hidden,DC=local
> 
> > > password: hidden
> 
> > > userbase: ‘DC=hidden,DC=hidden,DC=local’
> 
> > > # Filter to search for users (currently in the whole subtree beneath userbase)
> 
> > > # {0} is substituted with the username
> 
> > > usersearch: ‘(sAMAccountName={0})’
> 
> > > # Use this attribute from the user as username (if not set then DN is used)
> 
> > > username\_attribute: null
> 
> > > authz:
> 
> > > roles\_from\_myldap:
> 
> > > enabled: true
> 
> > > authorization\_backend:
> 
> > > # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
> 
> > > type: ldap # NOT FREE FOR COMMERCIAL USE
> 
> > > config:
> 
> > > # enable ldaps
> 
> > > enable\_ssl: false
> 
> > >
> 
> > > # enable start tls, enable\_ssl should be false
> 
> > > enable\_start\_tls: false
> 
> > > # send client certificate
> 
> > > enable\_ssl\_client\_auth: false
> 
> > > # verify ldap hostname
> 
> > > verify\_hostnames: true
> 
> > > hosts:
> 
> > > - [10.555.555.555:389](http://10.234.42.7:389/)
> 
> > > bind\_dn: CN=LdapUserReader,OU=Comptes de services,OU=hidden,DC=hidden,DC=hidden,DC=local
> 
> > > password: hidden
> 
> > > rolebase: ‘ou=Groupes de sécurité,ou=hidden,DC=hidden,DC=hidden,DC=local’
> 
> > > # Filter to search for roles (currently in the whole subtree beneath rolebase)
> 
> > > # {0} is substituted with the DN of the user
> 
> > > # {1} is substituted with the username
> 
> > > # {2} is substituted with an attribute value from user’s directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
> 
> > > rolesearch: ‘(member={0})’
> 
> > > # Specify the name of the attribute which value should be substituted with {2} above
> 
> > > userroleattribute: null
> 
> > > # Roles as an attribute of the user entry
> 
> > > userrolename: disabled
> 
> > > #userrolename: memberOf
> 
> > > # The attribute in a role entry containing the name of that role, Default is “name”.
> 
> > > # Can also be “dn” to use the full DN as rolename.
> 
> > > rolename: cn
> 
> > > # Resolve nested roles transitive (roles which are members of other roles and so on …)
> 
> > > resolve\_nested\_roles: true
> 
> > > userbase: ‘DC=hidden,DC=hidden,DC=local’
> 
> > > # Filter to search for users (currently in the whole subtree beneath userbase)
> 
> > > # {0} is substituted with the username
> 
> > > usersearch: ‘(sAMAccountName={0})’
> 
> > > # Skip users matching a user name, a wildcard or a regex pattern
> 
> > > #skip\_users:
> 
> > > # - ‘cn=Michael Jackson,ou\*people,o=TEST’
> 
> > > # - ‘/\S\*/’
> 
> > > roles\_from\_another\_ldap:
> 
> > > enabled: false
> 
> > > authorization\_backend:
> 
> > > type: ldap # NOT FREE FOR COMMERCIAL USE
> 
> > > #config goes here …
> 
> > >
> 
> > > ``