# Internal user not able to perform any operation

**URL:** <https://forum.opensearch.org/t/internal-user-not-able-to-perform-any-operation/14753>\
**Category:** Security\
**Tags:** troubleshoot, configure\
**Created:** [June 20, 2023, 2:27pm UTC](https://forum.opensearch.org/t/internal-user-not-able-to-perform-any-operation/14753 "2023-06-20T14:27:55Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![vmm-afonso](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vmm-afonso](https://forum.opensearch.org/u/vmm-afonso)\
**Post date:** [June 20, 2023, 2:27pm UTC](https://forum.opensearch.org/t/internal-user-not-able-to-perform-any-operation/14753/1 "2023-06-20T14:27:55Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

2.7.0

**Describe the issue** :

I added xxx internal user through the opensearch UI and I’m now trying to do any kind of operation with said user but opensearch doesn’t seem to recognize him, instead it is looking for him elsewhere (LDAP server)

**Configuration** :

**Relevant Logs or Screenshots** :

No ‘Authorization’ header, send 401 and ‘WWW-Authenticate Basic’  
[2023-06-20T13:41:35,730][WARN][c.a.d.a.l.b.LDAPAuthorizationBackend] [opensearch-cluster-ingest-2] In order to disable host name verification for LDAP connections (verify\_hostnames: true), you also need to set set the system property com.sun.jndi.ldap.object.disableEndpointIdentification to true when starting the JVM running OpenSearch. This applies for all Java versions released since July 2018.  
[2023-06-20T13:41:35,810][ERROR][o.o.s.a.BackendRegistry] [opensearch-cluster-ingest-2] Cannot retrieve roles for User [name=xxx, backend\_roles=[ingest], requestedTenant=null] from ldap due to OpenSearchSecurityException[OpenSearchSecurityException[No user xxx found]]; nested: OpenSearchSecurityException[No user xxx found];  
org.opensearch.OpenSearchSecurityException: OpenSearchSecurityException[No user xxx found]

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [June 20, 2023, 2:57pm UTC](https://forum.opensearch.org/t/internal-user-not-able-to-perform-any-operation/14753/2 "2023-06-20T14:57:22Z")

</div>

@vmm-afonso Please share your config.yml

---

<div class="post-metadata">

**Author:** ![vmm-afonso](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vmm-afonso](https://forum.opensearch.org/u/vmm-afonso)\
**Post date:** [June 20, 2023, 3:27pm UTC](https://forum.opensearch.org/t/internal-user-not-able-to-perform-any-operation/14753/3 "2023-06-20T15:27:52Z")

</div>

* * *

\_meta:  
type: “config”  
config\_version: 2  
config:  
dynamic:  
http:  
anonymous\_auth\_enabled: false  
xff:  
enabled: false  
internalProxies: \< internalProxies\>  
authc:  
kerberos\_auth\_domain:  
http\_enabled: false  
transport\_enabled: false  
order: 6  
http\_authenticator:  
type: “kerberos”  
challenge: true  
config:  
krb\_debug: false  
strip\_realm\_from\_principal: true  
authentication\_backend:  
type: “noop”  
basic\_internal\_auth\_domain:  
description: “Authenticate via HTTP Basic against internal users database”  
http\_enabled: true  
transport\_enabled: true  
order: 4  
http\_authenticator:  
type: “basic”  
challenge: true  
authentication\_backend:  
type: “intern”  
proxy\_auth\_domain:  
description: “Authenticate via proxy”  
http\_enabled: false  
transport\_enabled: false  
order: 3  
http\_authenticator:  
type: “proxy”  
challenge: false  
config:  
user\_header: “x-proxy-user”  
roles\_header: “x-proxy-roles”  
authentication\_backend:  
type: “noop”  
jwt\_auth\_domain:  
description: “Authenticate via Json Web Token”  
http\_enabled: false  
transport\_enabled: false  
order: 0  
http\_authenticator:  
type: “jwt”  
challenge: false  
config:  
signing\_key: “base64 encoded HMAC key or public RSA/ECDSA pem key”  
jwt\_header: “Authorization”  
jwt\_url\_parameter: null  
roles\_key: null  
subject\_key: null  
authentication\_backend:  
type: “noop”  
clientcert\_auth\_domain:  
description: “Authenticate via SSL client certificates”  
http\_enabled: false  
transport\_enabled: false  
order: 2  
http\_authenticator:  
type: “clientcert”  
config:  
username\_attribute: “cn”  
challenge: false  
authentication\_backend:  
type: “noop”  
ldap:  
description: “Authenticate via LDAP or Active Directory”  
http\_enabled: true  
transport\_enabled: false  
order: 5  
http\_authenticator:  
type: “basic”  
challenge: false  
authentication\_backend:  
type: “ldap”  
config:  
enable\_ssl: true  
enable\_start\_tls: false  
enable\_ssl\_client\_auth: false  
verify\_hostnames: false  
hosts:  
- “”  
bind\_dn: “ou=xxx,ou=xxx,ou=xxx,dc=xxx,dc=xxx”  
password:   
userbase: “ou=xxx,ou=xxx,dc=xxx,dc=xxx”  
usersearch: “(uid={0})”  
username\_attribute: “dn”  
authz:  
roles\_from\_myldap:  
description: “Authorize via LDAP or Active Directory”  
http\_enabled: true  
transport\_enabled: false  
authorization\_backend:  
type: “ldap”  
config:  
enable\_ssl: true  
enable\_start\_tls: false  
enable\_ssl\_client\_auth: false  
verify\_hostnames: false  
hosts:  
- “”  
bind\_dn: “ou=xxx,ou=xxx,ou=xxx,dc=xxx,dc=xxx”  
password:   
rolebase: “ou=xxx,ou=xxx,ou=xxx,dc=xxx,dc=xxx”  
rolesearch: “(member={0})”  
userroleattribute: “member”  
userrolename: “uid”  
rolename: “cn”  
resolve\_nested\_roles: true  
userbase: “ou=xxx,ou=xxx,dc=xxx,dc=xxx”  
usersearch: “(uid={0})”  
skip\_users:  
- “cn=x”  
roles\_from\_another\_ldap:  
description: “Authorize via another Active Directory”  
http\_enabled: false  
transport\_enabled: false  
authorization\_backend:  
type: “ldap”

---

<div class="post-metadata">

**Author:** ![vmm-afonso](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vmm-afonso](https://forum.opensearch.org/u/vmm-afonso)\
**Post date:** [June 20, 2023, 3:33pm UTC](https://forum.opensearch.org/t/internal-user-not-able-to-perform-any-operation/14753/4 "2023-06-20T15:33:24Z")

</div>

I did try adding the mentioned internal user to authz “skip\_users” without much success, but I may have not done it the right way here not sure

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [June 20, 2023, 5:04pm UTC](https://forum.opensearch.org/t/internal-user-not-able-to-perform-any-operation/14753/5 "2023-06-20T17:04:35Z")

</div>

@vmm-afonso Can you authenticate/authorize using LDAP users in OpenSearch Dashboards?

---

<div class="post-metadata">

**Author:** ![vmm-afonso](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vmm-afonso](https://forum.opensearch.org/u/vmm-afonso)\
**Post date:** [June 20, 2023, 5:41pm UTC](https://forum.opensearch.org/t/internal-user-not-able-to-perform-any-operation/14753/6 "2023-06-20T17:41:26Z")

</div>

Yes, I’m having no problem logging in to opensearch dashboards with LDAP users

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [June 20, 2023, 6:11pm UTC](https://forum.opensearch.org/t/internal-user-not-able-to-perform-any-operation/14753/7 "2023-06-20T18:11:06Z")

</div>

@vmm-afonso If you use more than one authentication domain, the OpenSearch security plugin will try to authenticate against all of them in the defined order.  
That’s why you see the observed errors in the OpenSearch logs. It’s not a bug, this is how the security plugin works by design.

In regards to the internal user. Did you assign any roles to that user? If so, could you share the corresponding entries from roles.yml and roles\_mapping.yml, and the user’s name?