LDAP fails when user is in a disabled group

Security
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Describe the issue:

The LDAP login fails when user is in a disabled group like CN=VZI Users 2,OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com . Error below from OS logs. If the user is removed from the disabled group this does not occur and user can login. Below also is my LDAP authc/authz. Please recommend a configuration to bypass the disabled group checks.

Configuration:

      vdsi_ldap:
        description: "Authenticate via LDAP or Active Directory"
        http_enabled: true
        transport_enabled: true
        order: 2
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          type: ldap
          config:
            enable_ssl: true                   
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: false 
            pemtrustedcas_filepath: "/vapews/devops/tools/ssl/ldap_vdsi_cert.pem"
            hosts:
            - "vdsilb.verizon.com:636" 
            follow_referrals: false
            bind_dn: "CN=SVC-vapews,OU=SVC,OU=FNA,DC=vdsi,DC=ent,DC=verizon,DC=com"
            password: "XXXXXX"
            userbase: "DC=vdsi,DC=ent,DC=verizon,DC=com"

  vdsi_ldap_roles:
    description: "LDAP Group Authorization"
    http_enabled: true
    transport_enabled: true
    authorization_backend:
      type: ldap
      config:
        enable_ssl: true
        enable_start_tls: false
        enable_ssl_client_auth: false
        verify_hostnames: false 
        pemtrustedcas_filepath: "/vapews/devops/tools/ssl/ldap_vdsi_cert.pem"
        hosts: "TPAP1T0ADCV01.vdsi.ent.verizon.com"
        follow_referrals: false
        bind_dn: "CN=SVC-vapews,OU=SVC,OU=FNA,DC=vdsi,DC=ent,DC=verizon,DC=com"
        password: "XXXXXXX"
        rolebase: "OU=VESLogs,OU=Groups,DC=vdsi,DC=ent,DC=verizon,DC=com"
        rolesearch: "(member={0})"
        rolename: "cn"

Relevant Logs or Screenshots:

{“type”: “server”, “timestamp”: “2026-07-28T08:09:25,117-0400”, “level”: “ERROR”, “component”: “o.o.s.a.BackendRegistry”, “cluster.name”: “opensearch-vbg-nonprod”, “node.name”: “tdcldjkwva013.ebiz.verizon.com-ml”, “message”: “Cannot retrieve roles for User [name=SHAIYU7, backend_roles=, requestedTenant=null] from ldap due to OpenSearchSecurityException[[org.ldaptive.LdapException@1593540578::resultCode=NO_SUCH_OBJECT, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1, message=javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-03152F3F, problem 2001 (NO_OBJECT), data 0, best match of:\n\t’OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com’\n\u0000]; remaining name ‘CN=VZI Users 2,OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com’, providerException=javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-03152F3F, problem 2001 (NO_OBJECT), data 0, best match of:\n\t’OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com’\n\u0000]; remaining name ‘CN=VZI Users 2,OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com’]]; nested: LdapException[javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-03152F3F, problem 2001 (NO_OBJECT), data 0, best match of:\n\t’OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com’\n\u0000]; remaining name ‘CN=VZI Users 2,OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com’]; nested: NameNotFoundException[[LDAP: error code 32 - 0000208D: NameErr: DSID-03152F3F, problem 2001 (NO_OBJECT), data 0, best match of:\n\t’OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com’\n\u0000]];”, “cluster.uuid”: “YtnQ2ybZQCaZRlvli4_Kpw”, “node.id”: “2cG_6YYqQB-gnxy0y7-1pA” ,

2

Hi @neil.chikode Could you please confirm which OpenSearch version you are currently running?

3

Opensearch version 3.7.0

4

According to the logs, the LDAP server returned NO_SUCH_OBJECT for the following distinguished name:

CN=VZI Users 2,OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com

The best match in the error is the parent OU, which suggests that the complete CN=VZI Users 2 object could not be located on the LDAP server queried at that time.

Could you please verify whether this object exists on TPAP1T0ADCV01.vdsi.ent.verizon.com by running the following command from the OpenSearch server?

LDAPTLS_REQCERT=never ldapsearch -LLL \
  -H "ldaps://TPAP1T0ADCV01.vdsi.ent.verizon.com:636" \
  -D "CN=SVC-vapews,OU=SVC,OU=FNA,DC=vdsi,DC=ent,DC=verizon,DC=com" \
  -W \
  -b "CN=VZI Users 2,OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com" \
  -s base \
  "(objectClass=*)"

Please share the command output after removing any sensitive information.

5

hi @Yanlin,

That’s the problem, the disabled groups are not searchable in the LDAP but are in the user’s profile. We need it to skip o.ver this disabled group checking. The user profile will have many different ADOM groups.

Update from our LDAP team:

We know the group exists. but the service account doesn’t and shouldn’t have rights to disabled OU.the question to them is why does it have to search for all the groups user is in… instead it should just search for groups that app uses to grant access

6

Hi @neil.chikode

Thanks for the update.
Could you please clarify what you mean by a disabled group, do you mean it has been deleted from Active Directory? Have you considered using the exclude_roles option in the LDAP authorization configuration?

https://docs.opensearch.org/latest/security/authentication-backends/ldap/#configuration-summary-1

7

hi @Yanlin

Could you provide a sample config for implementing the exclude_roles for:

CN=VZI Users 2,OU=DisabledGroups,OU=Disabled,DC=vdsi,DC=ent,DC=verizon,DC=com

I am new to setting up Opensearch configs and we never had this issue in Elastic.

8

Hi @neil.chikode, thank you for your update!

I tested exclude_roles and found that OpenSearch resolves each LDAP group before applying exclude_roles.

If the Bind DN user does not have permission to access the OU containing one of the user’s groups, the LDAP group resolution process fails, and no groups are returned as backend_roles. Therefore, exclude_roles cannot resolve this issue because the failure occurs before exclude_roles is applied.

This also explains why the user has no permissions when one of the groups referenced in the user’s memberOf attribute is located in the DisabledGroups OU and cannot be resolved by the Bind DN user.

Currently, OpenSearch does not provide an option to skip or filter out groups based on their OU before group resolution. The workaround is to grant the Bind DN user limited read access to the DisabledGroups OU so that it can resolve the group successfully.

If you would like this functionality to be supported, you can raise a feature request in the OpenSearch Security Plugin GitHub repository.

9

@Yanlin

Why does it need to resolve every group the user is in? Shouldn’t it just resolve the ones based on the rolebase? Most users are in dozens of group.

10

Hi @neil.chikode

I understand your point. However, this is the current implementation of the Security Plugin.

If you would like the plugin to handle group resolution differently, this would require an enhancement to the current implementation. You can raise a feature request in the OpenSearch Security Plugin GitHub repository for consideration.

If you create a feature request, please share the link here for traceability.

Many thanks,

Yanlin

11

@Yanlin

[Feature Request] Opensearch security LDAP shouldn’t try to resolve every ADOM group for a user · Issue #22680 · opensearch-project/OpenSearch