# LDAP Authentication: Not able to login; no Permissions for User

**URL:** <https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832>\
**Category:** Security\
**Created:** [September 5, 2022, 5:50pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832 "2022-09-05T17:50:00Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 5, 2022, 5:50pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/1 "2022-09-05T17:50:00Z")

</div>

Good evening,

I have read a lot of posts here with very similar problems but unfortunately none of them could help me. I am trying to login to OpenSearch with my LDAP credentials. My config.yml looks like this:

```
  ldap:
    http_enabled: true
    transport_enabled: true
    order: 1
    http_authenticator:
      type: basic
      challenge: true
    authentication_backend:
      type: ldap
      config:
        enable_ssl: true
        pemtrustedcas_filepath: '/path/to/opensearch/config/my-ca.pem'
        enable_start_tls: false
        enable_ssl_client_auth: false
        verify_hostnames: false
        hosts:
                - my-ldap-host.de:636
        bind_dn: "cn=xxx,ou=xxx,ou=xxx,ou=Groups,ou=group,ou=xxx,dc=xxx,dc=de"
        password: xxxx
        userbase: "ou=xxx,dc=xxx,dc=de"
        usersearch: '(sAMAccountName={0})'
        username_attribute: cn
authz:
  ldap:
    http_enabled: true
    transport_enabled: true
    authorization_backend:
      type: ldap
      config:
        enable_ssl: true
        pemtrustedcas_filepath: '/path/to/opensearch/config/my-ca.pem'
        enable_start_tls: false
        enable_ssl_client_auth: false
        verify_hostnames: false
        hosts:
                - my-ldap-host:636
        bind_dn: "cn=xxx,ou=xxx,ou=xxx,ou=Groups,ou=group,ou=xxx,dc=xxx,dc=de"
        password: xxxx
        userbase: "ou=xxx,dc=xxx,dc=de"
        usersearch: '(sAMAccountName={0})'
        username_attribute: cn
        rolebase: 'OU=xxx,OU=xxx,OU=Groups,OU=group,OU=xxx,DC=xxx,DC=de'
        rolesearch: '(member={0})'
        userroleattribute: null
        userrolename: none
        rolename: "name"
        resolve_nested_roles: true
        #rolesearch_enabled: false
        skip_users:
                - kibanaserver
                - admin

```

In `roles_mapping.yml` I added the following to the `all_access` role:

```auto
all_access:
  reserved: false
  backend_roles:
  - "admin"
  - "CN=xxx,OU=xxx,OU=xxx,OU=Groups,OU=group,OU=xxx,DC=xxx,DC=de"
  description: "Maps admin to all_access" 

```

OpenSearch Dashboards accepted the role map:

 ![all_access](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/9f8f684c258ebed28fee50de446515b9f5e86f31.png)

But nevertheless I get an Invalid username or password error when I try to login with my LDAP credentials. Also when I try to get cluster health I get

```auto
"error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "no permissions for [cluster:monitor/health] and User [name=my-resolved-ldap-name, backend_roles=[xxx, xxx], requestedTenant=null]"
      }

```

This error suggests that somehow my credentials are read by Opensearch because my login name is resolved as my name saved in LDAP although I did not use it anywhere in Opensearch.

Does anyone have an idea what is wrong with my configuration?

I would be very thankful for a respond!

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 5, 2022, 5:52pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/2 "2022-09-05T17:52:14Z")

</div>

P.S.: The user exists in LDAP. I already tested login with the credentials in an Elasticsearch Cluster and this works.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 5, 2022, 6:16pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/3 "2022-09-05T18:16:49Z")

</div>

@user2111 Could you try the following command?

```auto
curl --insecure -u <LDAP_USER> -XGET https://localhost:9200/_plugins/_security/authinfo?pretty

```

In response, you should get backend roles taken from AD. Since you’re using `name` as an attribute for the `rolename`

```auto
rolename: "name"

```

you’ll get only short names of the groups.

i.e.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/02e400fce11e113599a4c9b2a9775895d9197947.png)

That will fail to match your role binding where you’ve configured `dn` as a backend role.  
If you’d like to use `dn` instead, then you need to configure the below in your authz section.

```auto
rolename: "dn"

```

Then you’ll see the below output.

i.e.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/4/4638d020e9d9cf4c2ee9a5bd95ba59a5ae64476c.png)

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 6, 2022, 4:07pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/4 "2022-09-06T16:07:23Z")

</div>

Good afternoon @pablo ,  
I changed the rolename to “dn” and got the same as you with that command:

```auto
{
  "user" : "User [name=my-name, backend_roles=[CN=xxx,OU=xxx,OU=xxx,OU=Groups,OU=group,OU=xxx,DC=xxx,DC=de, CN=xxx,OU=xxx,OU=xxx,OU=Groups,OU=group,OU=xxx,DC=xxx,DC=de], requestedTenant=null]",
  "user_name" : "my-name",
  "user_requested_tenant" : null,
  "remote_address" : "host:port",
  "backend_roles" : [
    "CN=xxx,OU=xxx,OU=xxx,OU=Groups,OU=group,OU=xxx,DC=xxx,DC=de",
    "CN=xxx,OU=xxx,OU=xxx,OU=Groups,OU=group,OU=xxx,DC=xxx,DC=de"
  ],
  "custom_attribute_names" : [
...
]
  "roles" : [
    "own_index",
    "all_access"
  ],
  "tenants" : {
    "admin_tenant" : true,
    "global_tenant" : true,
    "my-name" : true
  },

```

Now I can see the cluster health with my ldap user, so this is an improvement, thank you for that!  
But still I cannot log in. Do I have to change also something else in my config?

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 7, 2022, 12:16pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/5 "2022-09-07T12:16:37Z")

</div>

To sum this up:  
The connection to the LDAP server works, which was proved by the commands

```auto
curl --insecure -u my-ldap-user -XGET https://myhost:9200/_plugins/_security/authinfo?pretty

```

because I get an excepted response, i.e. given as above, and

```auto
curl -XGET https://myhost:9200/_cluster/health?wait_for_status=yellow&timeout=50s&pretty --insecure -u my-ldap-user

```

where I also get the cluster health information.  
So my-ldap-user has the all\_access role but still cannot log in to OpenSearch Dashboards. I get the error message " **Invalid username or password, please try again**" on Dashboards.

I really have no idea where the problem could be. Do I have to set something in OpenSearch Dashboards such that LDAP authentication is accepted?

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 7, 2022, 2:43pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/6 "2022-09-07T14:43:58Z")

</div>

I think I can add one more thing:

My OpenSearch Dashboards logs look like this:

 ![dashboards](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/353af1af53ee6d96003224e04e9bde0c8e709ae5.png)  
The following is happening here: I log in with the fantasy name “test” and click the login button many times, nothing is happening except " **Invalid username or password, please try again**" and there comes `"message":"Failed authentication: Error: Authentication Exception"` in the logs.  
The red line is where I logged in with my real username. The first two times when I click the log in button there is the error message " **Invalid username or password, please try again**" in Dashboards and this is logged as `"message":"Failed authentication: Error: Authentication Exception"`. The third time I click the button the Dashboards page reloads with blank input space and the logs are `"message":"Failed to resolve user tenant: Error: Failed authentication: Authentication Exception"`.  
So something is happening but not correctly and for this reason I thought that maybe this is a problem with the OpenSearch Dashboards configuration.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 7, 2022, 3:25pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/7 "2022-09-07T15:25:59Z")

</div>

@user2111 I have a question about this line below.

```auto
pemtrustedcas_filepath: '/path/to/opensearch/config/my-ca.pem'

```

Is this OpenSearch root CA or AD?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 7, 2022, 3:28pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/8 "2022-09-07T15:28:30Z")

</div>

@user2111 Could you share your opensearch.yml and opensearch\_dashboards.yml files?

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 7, 2022, 3:47pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/9 "2022-09-07T15:47:06Z")

</div>

Thank you very much for your respond @pablo .  
The certificate `my-ca.pem` is for LDAP, the nodes and Dashboards are using `root-ca.pem`.  
The relevant part of my OpenSearch yml for node1 looks like this:

```auto

cluster.initial_cluster_manager_nodes: ["node1", "node2", "node3"]
plugins.security.ssl.transport.pemcert_filepath: node1.pem
plugins.security.ssl.transport.pemkey_filepath: node1-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: node1.pem
plugins.security.ssl.http.pemkey_filepath: node1-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
plugins.security.authcz.admin_dn:
  - 'CN=ADMIN'
plugins.security.nodes_dn:
  - 'CN=node1'
  - 'CN=node2'
  - 'CN=node3'
plugins.security.system_indices.enabled: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]

```

and the relevant part of my OpenSearch Dashboards yml looks like this:

```auto
opensearch.hosts: xxx
opensearch.ssl.verificationMode: certificate
opensearch.username: kibanaserver
opensearch.password: xxx
opensearch.requestHeadersAllowlist: [authorization, securitytenant]
server.ssl.enabled: true
server.ssl.certificate: /path/to/cert/client.pem
server.ssl.key: /path/to/cert/client-key.pem
opensearch.ssl.certificateAuthorities: /path/to/cert/root-ca.pem

opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: [Private, Global]
opensearch_security.readonly_mode.roles: [kibana_read_only]
# Use this setting if you are running opensearch-dashboards without https
opensearch_security.cookie.secure: true

```

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 8, 2022, 7:00am UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/10 "2022-09-08T07:00:49Z")

</div>

To be more precise: I am using a three-node OpenSearch cluster which with three different hosts, OpenSearch Dashboards is on a forth host and LDAP is also on a different host. The three nodes and the Dashboards host are using `root-ca.pem`, node certificates and a client certificate. The LDAP server is using `my-ca.pem` as CA.  
Maybe I have to somehow configure `my-ca.pem` also in Dashboards?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 9, 2022, 2:33pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/11 "2022-09-09T14:33:58Z")

</div>

@user2111 You don’t need to provide an AD certificate in the opensearch\_dashboards.yml config file.

I’ve got confused a little bit. In the following thread, you stated that LDAP authentication is working and now you need to assign the roles.

> [@Opensearch connection error with LDAP server](https://forum.opensearch.org/t/opensearch-connection-error-with-ldap-server/10799):
>
> Good evening, I would like to enable authentication and authorization with LDAP and for this purpose I am following I edited the config.yml file similarly as described there with my own credentials and with giving the path to another ca file as used in the nodes. Then I updated Opensearch by running securityadmin.sh. My hostname at config: hosts: has the form config: hosts: - ldaps://example.de:636 I get a java.lang.NumberFormatException with this host. I also tried some variations an…

Could you confirm that?  
Is it the same environment?

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 9, 2022, 3:00pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/12 "2022-09-09T15:00:18Z")

</div>

@pablo Good evening,  
yes that is the same environment. I am sorry for the confusion with the vocabulary. The authentication is not working yet, what I meant to say is that the connection to the LDAP server is working.  
I still cannot login, my current situation is as described in this thread.

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 9, 2022, 3:09pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/13 "2022-09-09T15:09:19Z")

</div>

So I have a very strange error.  
The connection to the LDAP server is working. I know this because when I change some settings as the bind\_dn or the password there is a connection error and now with this settings there is no connection error.  
The role mapping is working since `curl --insecure -u <LDAP_USER> -XGET https://localhost:9200/_plugins/_security/authinfo?pretty`gives me the correct roles. And I also have access to the cluster since cluster health with the \<LDAP\_USER\> shows me the correct output.  
But still the login with \<LDAP\_USER\> in Dashboards is not working.

---

<div class="post-metadata">

**Author:** ![vi4life](https://avatars.discourse-cdn.com/v4/letter/v/a88e4f/32.png) [@vi4life](https://forum.opensearch.org/u/vi4life)\
**Post date:** [September 10, 2022, 7:41am UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/14 "2022-09-10T07:41:17Z")

</div>

Hello,  
just to have all the info.  
Are the config.yml and roles\_mapping.yml the only configs you pushed?

Were you able to log in to OpenSearch Dashboards with the internal admin user?

I would imagine that the cause of this issue is a problem with the internal kibanaserver user, since OpenSearch Dashboards connects to OpenSearch with that user.

My second thought is that you need to restart the OpenSearch Dashboards service. I know this is very unlikely, but could you please try this?

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [September 10, 2022, 8:50am UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/15 "2022-09-10T08:50:57Z")

</div>

Hello @vi4life,  
thank you very much for your respond.

I am able to log in to Dashboards with my `admin` user and with my `kibanaserver` user.

I restarted Dashboards but it did not change the issue.

I load all config files that are in the config directory with `securityadmin.sh` but `config.yml` and `roles_mapping.yml` are the only two where I made changes, the others are in default configuration.

> [@vi4life](#):
>
> I would imagine that the cause of this issue is a problem with the internal kibanaserver user, since OpenSearch Dashboards connects to OpenSearch with that user.

What do you think could the problem with the kibanaserver user be and how could I solve this?

---

<div class="post-metadata">

**Author:** ![vi4life](https://avatars.discourse-cdn.com/v4/letter/v/a88e4f/32.png) [@vi4life](https://forum.opensearch.org/u/vi4life)\
**Post date:** [September 10, 2022, 10:31am UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/16 "2022-09-10T10:31:49Z")

</div>

Then maybe the kibanaserver user is not the problem.  
I had a similar problem. I changed the default password of the Kibanaserver user, edited the password in the dashboards configuration, but did not restart the dashboards so I could not log in.

Could you please provide the log from the OpenSearch server that the OpenSearch dashboards is trying to connect to?  
Maybe a simple reinstallation will help. Or maybe the version of the Dashboard and OpenSearch do not match. Recently version 2.2.1 was released, maybe the dashboard is newer or older than the other components.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 12, 2022, 12:16pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/17 "2022-09-12T12:16:58Z")

</div>

@user2111 Based on your previous responses, OpenSearch Dashboards is not an issue as you can log in with a local user.  
OpenSearch’s security plugin handles LDAP authentication and there is no need for extra configuration in OpenSearch Dashboards.

You’ve mentioned that you have 3 nodes cluster. Maybe the issue is in one of your nodes.  
Please try to log in from OpenSearch Dashboards with LDAP user and collect logs from all three OpenSearch nodes.  
Also check /etc/hosts on all three nodes against the DC.

Alternatively, try to replace the FQDN of your AD with an IP address in config.yml and see if that resolves the issue.

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [October 5, 2022, 10:21am UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/18 "2022-10-05T10:21:49Z")

</div>

> [@pablo](#):
>
> You’ve mentioned that you have 3 nodes cluster. Maybe the issue is in one of your nodes.  
> Please try to log in from OpenSearch Dashboards with LDAP user and collect logs from all three OpenSearch nodes.  
> Also check /etc/hosts on all three nodes against the DC.

Hello @pablo ,

I am sorry for the late respond. This comment of yours seems very interesting. I tried

```auto
<LDAP_USER> -XGET https://localhost:9200/_plugins/_security/authinfo?pretty

```

with the ip of the other nodes and I get the respond `Unauthorized`. So as you suspected this could be a sign that I have to configure something on the other nodes.

Do you have an idea what exactly I would have to do?

I thought the config files only have to be changed on one node and then initialized with `securityadmin.sh` only on one node.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 5, 2022, 11:32am UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/19 "2022-10-05T11:32:03Z")

</div>

@user2111 You’re correct. The config has to be applied once with one of the nodes and it will apply to all nodes in the cluster.  
The reason why I was asking you to check each node was to test connectivity to the LDAP server - name resolution.

Could you confirm that you can resolve `my-ldap-host.de` on each node?

Also, try to execute the below command from each node.

```auto
env LDAPTLS_REQCERT=never ldapsearch -b "dc=xxx,dc=de" -H ldaps://my-ldap-host.de:636 -D "<bind_dn>" -w "<password>"

```

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [October 5, 2022, 12:26pm UTC](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/20 "2022-10-05T12:26:32Z")

</div>

@pablo Thank you very much. After trying

```auto
env LDAPTLS_REQCERT=never ldapsearch -b "dc=xxx,dc=de" -H ldaps://my-ldap-host.de:636 -D "<bind_dn>" -w "<password>"

```

I discovered that `ldap-utils` was not installed on the other two nodes. After installing it I ran the command again and I can confirm that I can reach the ldap server from every node.  
Also I restarted Opensearch on every node and ran `securityadmin.sh` again on one node.  
Still I get an `Unauthorized` when I run  
`<LDAP_USER> -XGET https://localhost:9200/_plugins/_security/authinfo?pretty`  
on the two nodes where I did not run `securityadmin.sh` and still the same respond on the one node.

> [@pablo](#):
>
> The reason why I was asking you to check each node was to test connectivity to the LDAP server - name resolution.
> 
> Could you confirm that you can resolve `my-ldap-host.de` on each node?

What do you exactly mean by this?

[Next page](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832.md?page=2)