# Security manager fails sometimes **URL:** \ **Category:** Search Guard\ **Created:** [September 27, 2023, 2:24pm UTC](https://forum.search-guard.com/t/security-manager-fails-sometimes/2466 "2023-09-27T14:24:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [September 27, 2023, 2:24pm UTC](https://forum.search-guard.com/t/security-manager-fails-sometimes/2466/1 "2023-09-27T14:24:43Z")
Elasticsearch version: 7.17.12 Server OS version: Rocky Linux release 8.8 (Green Obsidian) Java version: openjdk version “17.0.8.1” 2023-08-24 Search Guard version: 1.3.0-es-7.17.12 Describe the issue: When I’m doing many requests in parallels, some of them fails, and in the log, I’m getting the following stack: ```auto [2023-09-27T16:14:43,273][ERROR][c.f.s.a.b.RequestAuthenticationProcessor] [XXX-1] Error while authenticating AuthCredentials [username=XXXX, subUserName=null, authDomainInfo=AuthDomainInfo [authDomainId=null, authenticatorType=trusted_origin, authBackend Type=null], password=null, nativeCredentials=null, backendRoles=[], searchGuardRoles=[], complete=true, authzComplete=false, redirectUri=null, attributes={}, structuredAttributes={}, claims={}, attributesForUserMapping={credentials={user_name=n/a}, request ={headers=org.elasticsearch.http.netty4.Netty4HttpRequest$HttpHeadersMap@771fcdd5, direct_ip_address=XXXX, originating_ip_address=XXX}}] {ldap_rc=91 (connect error)} com.floragunn.searchguard.authc.AuthenticatorUnavailableException: Error while creating connection to LDAP server LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to connect to server XXXX:636: IOException(LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to establish a connection to server XXXX/XXX:636: AccessControlException(access denied ("java.net.SocketPermission" "XXXX:636" "connect,resolve")), ldapSDKVersion=5.0.1, revision=3290ee33d4aa17df1aadb4d814d6534375f395a 9'))') at com.floragunn.searchguard.enterprise.auth.ldap.LDAPConnectionManager.getConnection(LDAPConnectionManager.java:270) ~[dlic-search-guard-flx-security-1.3.0-es-7.17.12.jar:1.3.0-es-7.17.12] at com.floragunn.searchguard.enterprise.auth.ldap.LDAPAuthenticationBackend.searchGroups(LDAPAuthenticationBackend.java:219) ~[dlic-search-guard-flx-security-1.3.0-es-7.17.12.jar:1.3.0-es-7.17.12] at com.floragunn.searchguard.enterprise.auth.ldap.LDAPAuthenticationBackend.getUserInformation(LDAPAuthenticationBackend.java:161) ~[dlic-search-guard-flx-security-1.3.0-es-7.17.12.jar:1.3.0-es-7.17.12] at com.floragunn.searchguard.authc.base.StandardAuthenticationDomain.authenticate(StandardAuthenticationDomain.java:343) ~[search-guard-flx-security-1.3.0-es-7.17.12.jar:1.3.0-es-7.17.12] at com.floragunn.searchguard.authc.base.RequestAuthenticationProcessor.callAuthcBackends(RequestAuthenticationProcessor.java:379) [search-guard-flx-security-1.3.0-es-7.17.12.jar:1.3.0-es-7.17.12] ... Caused by: java.security.AccessControlException: access denied ("java.net.SocketPermission" "XXXX:636" "connect,resolve") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:485) ~[?:?] at java.security.AccessController.checkPermission(AccessController.java:1068) ~[?:?] at java.lang.SecurityManager.checkPermission(SecurityManager.java:416) ~[?:?] at java.lang.SecurityManager.checkConnect(SecurityManager.java:919) ~[?:?] at java.net.Socket.connect(Socket.java:629) ~[?:?] at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:304) ~[?:?] at com.unboundid.ldap.sdk.ConnectThread.run(ConnectThread.java:163) ~[unboundid-ldapsdk-5.0.1.jar:5.0.1] ``` The LDAP connection configuration is: ```auto idp: tls: trust_all: false enabled_protocols: - "TLSv1.2" - "TLSv1.3" hosts: - "XXXX:636" connection_pool: min_size: 5 max_size: 5 bind_dn: "XXXX" password: "XXXX" user_search: filter: by_attribute: "sAMAccountName" base_dn: "XXXX" group_search: base_dn: "XXX" recursive: enabled: true role_name_attribute: "dn" ``` I don’t understand why in some case the security manager fails, but not all the time. Look like a concurency bug for me. It’s critical, it prevent from upgrading to flx and I don’t see any work around. ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.search-guard.com/u/Eugene7)\ **Post date:** [September 28, 2023, 12:27pm UTC](https://forum.search-guard.com/t/security-manager-fails-sometimes/2466/2 "2023-09-28T12:27:39Z")
Hi @fbacchella What IAM tool do you use for LDAP authentication? ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [September 28, 2023, 1:48pm UTC](https://forum.search-guard.com/t/security-manager-fails-sometimes/2466/3 "2023-09-28T13:48:08Z")
It’s a plain ActiveDirectory. But the exceptions is thrown from a SecurityManager, so I don’t think that will change anything. ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [October 9, 2023, 3:18pm UTC](https://forum.search-guard.com/t/security-manager-fails-sometimes/2466/4 "2023-10-09T15:18:26Z")
No answer about my problem ? ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.search-guard.com/u/Eugene7)\ **Post date:** [October 9, 2023, 3:41pm UTC](https://forum.search-guard.com/t/security-manager-fails-sometimes/2466/5 "2023-10-09T15:41:16Z")
Could you share your `elasticsearch.yml`? Please change or remove sensitive details. Do you know approximately how many requests in parallel you had? ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [October 9, 2023, 4:12pm UTC](https://forum.search-guard.com/t/security-manager-fails-sometimes/2466/6 "2023-10-09T16:12:31Z")
I’m a paying client. So is it possible to open a private ticket ? ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\ **Post date:** [October 30, 2023, 4:13pm UTC](https://forum.search-guard.com/t/security-manager-fails-sometimes/2466/7 "2023-10-30T16:13:13Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed. ---
**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\ **Post date:** [November 9, 2023, 9:21am UTC](https://forum.search-guard.com/t/security-manager-fails-sometimes/2466/8 "2023-11-09T09:21:25Z")
This is being worked on. You can track the progress at [LDAP connection pool fails with java.security.AccessControlException: access denied ("java.net.SocketPermission") when scaling up (#256) · Issues · search-guard / Search Guard Suite Enterprise · GitLab](https://git.floragunn.com/search-guard/search-guard-suite-enterprise/-/issues/256)