AD auth error on graylog setup

[cardosocristian (Cristian Cardoso)]

When trying to configure authentication via active directory I get an error screen in the graylog.
This error is displayed on the web interface
“Cannot convert undefined or null to object”

And in the server log this:

2020-07-27T11:18:31.927-03:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
java.lang.RuntimeException: ERR_02002_FAILURE_ON_UNDERLYING_CURSOR Failure on underlying Cursor.
at org.apache.directory.api.ldap.model.cursor.CursorIterator.next(CursorIterator.java:89) ~[graylog.jar:?]
at org.graylog2.security.ldap.LdapConnector.search(LdapConnector.java:142) ~[graylog.jar:?]
at org.graylog2.rest.resources.system.ldap.LdapResource.testLdapConfiguration(LdapResource.java:183) ~[graylog.jar:?]
at sun.reflect.GeneratedMethodAccessor777.invoke(Unknown Source) ~[?:?]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_252]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_252]
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) ~[graylog.jar:?]
at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_252]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_252]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_252]
Caused by: org.apache.directory.api.ldap.model.cursor.CursorLdapReferralException
at org.apache.directory.ldap.client.api.EntryCursorImpl.get(EntryCursorImpl.java:174) ~[graylog.jar:?]
at org.apache.directory.ldap.client.api.EntryCursorImpl.get(EntryCursorImpl.java:52) ~[graylog.jar:?]
at org.apache.directory.api.ldap.model.cursor.CursorIterator.next(CursorIterator.java:82) ~[graylog.jar:?]
… 28 more

Operating system: Centos 7
Graylog version: 3.3.2 + ade4779
Java: 1.8.0_252

[shoothub]

Please post your LDAP configuration…

[cardosocristian (Cristian Cardoso)]

Server type: Active Directory
Server Address: ldap://10.7.110.2:389
System Username: grafana@dc.local
Connection validation occurs normally

Search Base DN DC=DC,DC=local
Display Name attribute displayName
User Search Pattern (sAMAccountName=%s) or (&(objectClass=user)(sAMAccountName={0}))
I’ve tried these two ways.
If I try with that value (& (objectClass = user) (sAMAccountName = {0}))
I get this error “Binding with empty principal is forbidden”

If I try to use (sAMAccountName =% s) *, when I validate the login, at the end of the page, it changes to the page that something is wrong and returns the error “Cannot convert undefined or null to object”

Display Name attribute displayName

[ttsandrew]

Hey @cardosocristian,

Here’s our working configuration for comparison:

Server type: Active Directory
Server Address: ldap://dc01.contoso.com
System Username: graylog_sa@contoso.com

Search Base DN: ou=enterprise,dc=contoso,dc=com
Display Name attribute displayName
User Search Pattern (&(memberof=CN=Graylog Admins,OU=Enterprise Security Groups,OU=Enterprise,DC=contoso,DC=com)(sAMAccountName={0}))

[cardosocristian (Cristian Cardoso)]

Does the graylog user in AD need administrator permission?

[ttsandrew]

Ours is just a regular domain user.

[ttsandrew]

I have been trying a variety of combinations of your configurations above and have been unable to reproduce your error. I did find a couple of threads talking about the same issue, though. Do either of the following apply?

Binding with empty principal is forbidden

Hi folks, I am configuring Active Directory Authentication with graylog. Connection to the domain controller is working. All parameter seems to be correct [2018-03-01%2014_51_58-Graylog%20-%20LDAP%20Settings] LDAP group mapping shows the group GrayLogRO set to Reader. When i use the account to test. It says the user is found but I get an error on login attempt. [2018-03-01%2014_54_26-Graylog%20-%20LDAP%20Settings] Any idea what i might be doing wrong. I am on latest version of graylog.

Unable to configure External Authentication on GrayLog- LDAP/Active Directory and SSO Authentication

Hi Everybody, I am new to Graylog, working on POC to implement GrayLog for all our applications and I am unable to configure external authentications like SSO and LDAP/Active Directory. We followed this documentation https://docs.graylog.org/en/3.1/pages/users_and_roles/external_auth.html For LDAP/Active Directory: Test server connection is getting successful but test login is failing, so suspecting something we are doing wrong on User Mapping section. [image] We are getting below error wh…

A common theme mentioned by @jan is a problem with group nesting.

[shoothub]

1. I have similar error, if I put username in format username@domain.com in section Login test. Try to use only username without (@domain.com) in first field in this section. Also it’s better to save settings before testing.
2. Don’t try to use LDAP without enctyption, because passwords are transfered completely as plain text. Better is to either use LDAPS (check SSL and use port 636) or LDAP using StartTLS (Check StartTLS and port 389).