# AD auth error on graylog setup
**URL:** https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550
**Category:** Graylog Central (peer support)
**Created:** [July 27, 2020, 2:31pm UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550 "2020-07-27T14:31:20Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@cardosocristian](https://community.graylog.org/u/cardosocristian)
#### Post date: [July 27, 2020, 2:31pm UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550/1 "2020-07-27T14:31:20Z")
When trying to configure authentication via active directory I get an error screen in the graylog.
This error is displayed on the web interface
“Cannot convert undefined or null to object”
And in the server log this:
2020-07-27T11:18:31.927-03:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
java.lang.RuntimeException: ERR\_02002\_FAILURE\_ON\_UNDERLYING\_CURSOR Failure on underlying Cursor.
at org.apache.directory.api.ldap.model.cursor.CursorIterator.next(CursorIterator.java:89) ~[graylog.jar:?]
at org.graylog2.security.ldap.LdapConnector.search(LdapConnector.java:142) ~[graylog.jar:?]
at org.graylog2.rest.resources.system.ldap.LdapResource.testLdapConfiguration(LdapResource.java:183) ~[graylog.jar:?]
at sun.reflect.GeneratedMethodAccessor777.invoke(Unknown Source) ~[?:?]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0\_252]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0\_252]
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) ~[graylog.jar:?]
at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0\_252]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0\_252]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_252]
Caused by: org.apache.directory.api.ldap.model.cursor.CursorLdapReferralException
at org.apache.directory.ldap.client.api.EntryCursorImpl.get(EntryCursorImpl.java:174) ~[graylog.jar:?]
at org.apache.directory.ldap.client.api.EntryCursorImpl.get(EntryCursorImpl.java:52) ~[graylog.jar:?]
at org.apache.directory.api.ldap.model.cursor.CursorIterator.next(CursorIterator.java:82) ~[graylog.jar:?]
… 28 more
Operating system: Centos 7
Graylog version: 3.3.2 + ade4779
Java: 1.8.0\_252
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [July 30, 2020, 4:47pm UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550/2 "2020-07-30T16:47:38Z")
Please post your LDAP configuration…
---
### Author:  [@cardosocristian](https://community.graylog.org/u/cardosocristian)
#### Post date: [July 31, 2020, 1:40pm UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550/3 "2020-07-31T13:40:24Z")
Server type: Active Directory
Server Address: ldap://10.7.110.2:389
System Username: grafana@dc.local
Connection validation occurs normally
Search Base DN **DC=DC,DC=local**
Display Name attribute **displayName**
User Search Pattern **(sAMAccountName=%s)** or **(&(objectClass=user)(sAMAccountName={0}))**
I’ve tried these two ways.
If I try with that value (& (objectClass = user) (sAMAccountName = {0}))
I get this error “Binding with empty principal is forbidden”
If I try to use (sAMAccountName =% s) \*, when I validate the login, at the end of the page, it changes to the page that something is wrong and returns the error “Cannot convert undefined or null to object”
Display Name attribute **displayName**
---
### Author:  [@ttsandrew](https://community.graylog.org/u/ttsandrew)
#### Post date: [July 31, 2020, 2:31pm UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550/4 "2020-07-31T14:31:08Z")
Hey @cardosocristian,
Here’s our working configuration for comparison:
Server type: Active Directory
Server Address: ldap://dc01.contoso.com
System Username: [graylog\_sa@contoso.com](mailto:graylog_sa@contoso.com)
Search Base DN: ou=enterprise,dc=contoso,dc=com
Display Name attribute displayName
User Search Pattern (&(memberof=CN=Graylog Admins,OU=Enterprise Security Groups,OU=Enterprise,DC=contoso,DC=com)(sAMAccountName={0}))
---
### Author:  [@cardosocristian](https://community.graylog.org/u/cardosocristian)
#### Post date: [July 31, 2020, 6:00pm UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550/5 "2020-07-31T18:00:49Z")
Does the graylog user in AD need administrator permission?
---
### Author:  [@ttsandrew](https://community.graylog.org/u/ttsandrew)
#### Post date: [July 31, 2020, 6:46pm UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550/6 "2020-07-31T18:46:11Z")
Ours is just a regular domain user.
---
### Author:  [@ttsandrew](https://community.graylog.org/u/ttsandrew)
#### Post date: [July 31, 2020, 7:59pm UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550/7 "2020-07-31T19:59:00Z")
I have been trying a variety of combinations of your configurations above and have been unable to reproduce your error. I did find a couple of threads talking about the same issue, though. Do either of the following apply?
> [@Binding with empty principal is forbidden](https://community.graylog.org/t/binding-with-empty-principal-is-forbidden/4401):
>
> Hi folks, I am configuring Active Directory Authentication with graylog. Connection to the domain controller is working. All parameter seems to be correct [2018-03-01%2014\_51\_58-Graylog%20-%20LDAP%20Settings] LDAP group mapping shows the group GrayLogRO set to Reader. When i use the account to test. It says the user is found but I get an error on login attempt. [2018-03-01%2014\_54\_26-Graylog%20-%20LDAP%20Settings] Any idea what i might be doing wrong. I am on latest version of graylog.
> [@Unable to configure External Authentication on GrayLog- LDAP/Active Directory and SSO Authentication](https://community.graylog.org/t/unable-to-configure-external-authentication-on-graylog-ldap-active-directory-and-sso-authentication/12667):
>
> Hi Everybody, I am new to Graylog, working on POC to implement GrayLog for all our applications and I am unable to configure external authentications like SSO and LDAP/Active Directory. We followed this documentation [https://docs.graylog.org/en/3.1/pages/users\_and\_roles/external\_auth.html](https://docs.graylog.org/en/3.1/pages/users_and_roles/external_auth.html) For LDAP/Active Directory: Test server connection is getting successful but test login is failing, so suspecting something we are doing wrong on User Mapping section. We are getting below error wh…
A common theme mentioned by @jan is a problem with group nesting.
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [August 3, 2020, 7:25am UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550/8 "2020-08-03T07:25:31Z")
1. I have similar error, if I put username in format `username@domain.com` in section `Login test`. Try to use only `username` without (@domain.com) in first field in this section. Also it’s better to save settings before testing.
2. Don’t try to use LDAP without enctyption, because passwords are transfered completely as plain text. Better is to either use `LDAPS` (check `SSL` and use `port 636`) or `LDAP using StartTLS` (Check `StartTLS` and `port 389`).
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [August 17, 2020, 7:25am UTC](https://community.graylog.org/t/ad-auth-error-on-graylog-setup/16550/9 "2020-08-17T07:25:34Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.