Hi,
I am facing issues with Issues with ldap integration
We have a 3 node Open Search Cluster.
We have configured ldap authentication and ran the security plugin script. Its successfull, but we are unable to login using the ldap users.
Below is the config.yml file and the error in the cluster logs
_meta:
type: “config”
config_version: 2
config:
dynamic:
http:
anonymous_auth_enabled: false
xff:
enabled: false
internalProxies: ‘192.168.0.10|192.168.0.11’ # regex pattern
authc:
basic_internal_auth_domain:
description: “Authenticate via HTTP Basic against internal users database”
http_enabled: true
transport_enabled: true
order: 4
http_authenticator:
type: basic
challenge: true
authentication_backend:
type: intern
ldap:
http_enabled: true
transport_enabled: true
order: 1
http_authenticator:
type: basic
challenge: true
authentication_backend:
type: ldap
config:
enable_ssl: false
enable_start_tls: false
enable_ssl_client_auth: false
verify_hostnames: true
hosts:
- ADNode1.abcdomain.lan:389
- ADNode2.abcdomain.lan:389
bind_dn: cn=srv.gt.procSRE.elk,ou=service,ou=Users,ou=Datacenter,dc=abcdomain,dc=lan
password: XXXXXXXXXX
userbase: ‘cn=GL_Getnet-Proc-CDE-ElkAdmin,ou=Opensearch,ou=GROUPS APPLICATION,ou=CHENNAI,ou=INDIA,ou=ASIA,dc=abcdomain,dc=lan’
usersearch: ‘(uid={0})’
username_attribute: uid
authz:
ldap:
http_enabled: true
transport_enabled: true
authorization_backend:
type: ldap
config:
enable_ssl: false
enable_start_tls: false
enable_ssl_client_auth: false
verify_hostnames: true
hosts:
- ADNode1.abcdomain.lan:389
- ADNode2.abcdomain.lan:389
bind_dn: cn=srv.gt.procSRE.elk,ou=service,ou=Users,ou=Datacenter,dc=abcdomain,dc=lan
password: oT9aMsfsh8HA
userbase: ‘cn=GL_Getnet-Proc-CDE-ElkAdmin,ou=Opensearch,ou=GROUPS APPLICATION,ou=CHENNAI,ou=INDIA,ou=ASIA,dc=abcdomain,dc=lan’
usersearch: ‘(uid={0})’
username_attribute: uid
rolebase: ‘cn=GL_Getnet-Proc-CDE-ElkAdmin,ou=Opensearch,ou=GROUPS APPLICATION,ou=CHENNAI,ou=INDIA,ou=ASIA,dc=abcdomain,dc=lan’
rolesearch: ‘(member={0})’
userroleattribute: null
userrolename: none
rolename: cn
resolve_nested_roles: true
Error in Cluster log
Caused by: org.ldaptive.LdapException: Unable to connect to any of those ldap servers [ADNode1.abcdomain.lan:389, ADNode2.abcdomain.lan:389] due to [org.ldaptive.LdapException@277590303::resultCode=INVALID_CREDENTIALS, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1, message=javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090447, comment: AcceptSecurityContext error, data 52e, v3839], providerException=javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090447, comment: AcceptSecurityContext error, data 52e, v3839]]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend.getConnection0(LDAPAuthorizationBackend.java:360) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend$2.run(LDAPAuthorizationBackend.java:166) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend$2.run(LDAPAuthorizationBackend.java:156) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
at java.security.AccessController.doPrivileged(AccessController.java:569) ~[?:?]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend.getConnection(LDAPAuthorizationBackend.java:156) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend.fillRoles(LDAPAuthorizationBackend.java:715) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
… 72 more
Caused by: org.ldaptive.LdapException: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090447, comment: AcceptSecurityContext error, data 52e, v3839]
at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:55) ~[ldaptive-1.2.3.jar:?]
at org.ldaptive.provider.jndi.JndiConnection.processNamingException(JndiConnection.java:619) ~[ldaptive-1.2.3.jar:?]
at org.ldaptive.provider.jndi.JndiConnection.simpleBind(JndiConnection.java:261) ~[ldaptive-1.2.3.jar:?]
at org.ldaptive.provider.jndi.JndiConnection.bind(JndiConnection.java:203) ~[ldaptive-1.2.3.jar:?]
at org.ldaptive.BindOperation.invoke(BindOperation.java:28) ~[ldaptive-1.2.3.jar:?]
at org.ldaptive.BindOperation.invoke(BindOperation.java:9) ~[ldaptive-1.2.3.jar:?]
at org.ldaptive.AbstractOperation.execute(AbstractOperation.java:126) ~[ldaptive-1.2.3.jar:?]
at org.ldaptive.BindConnectionInitializer.initialize(BindConnectionInitializer.java:156) ~[ldaptive-1.2.3.jar:?]
at org.ldaptive.DefaultConnectionFactory$DefaultConnection.open(DefaultConnectionFactory.java:269) ~[ldaptive-1.2.3.jar:?]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend.getConnection0(LDAPAuthorizationBackend.java:328) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend$2.run(LDAPAuthorizationBackend.java:166) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend$2.run(LDAPAuthorizationBackend.java:156) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
at java.security.AccessController.doPrivileged(AccessController.java:569) ~[?:?]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend.getConnection(LDAPAuthorizationBackend.java:156) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend.fillRoles(LDAPAuthorizationBackend.java:715) ~[opensearch-security-2.1.0.0.jar:2.1.0.0]
… 72 more
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090447, comment: AcceptSecurityContext error, data 52e, v3839]
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3260) ~[?:?]
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3206) ~