Graylog AD integration fails

Graylog Central (peer support)
1

Getting this error setting AD integration,

GLusers
GLusers717×782 109 KB

It looks user was found in AD but authentication fails.
Let me know if you guys need more info about my AD.

please any help will be appreciated.
jc

2

There is the server’s response. And also you can check your AD’s log for more information.
But you don’t share your LDAP settings in graylog, so how can we help more?

3

thank you for you for answering back, please let me know if this is what you asking for:
Search Base DN : cn=users,dc=lan,dc=leiszler,dc=org

User Search Pattern: (|(objectCategory=person)(objectClass=user)(sAMAccountName={0})(memberOf=CN=Graylog,DC=lan,DC=leiszler,DC=org)))

Display Name attribute: displayName
Group Search Base DN:dc=lan,dc=leiszler,dc=org
Group Search Pattern: (&(objectClass=group)(cn=graylog*))
Group Name Attribute:cn

regards
jc

4

I’M not sure the username with $ is a good choice. Have you tried with a normal user?

5

what you mean “the user name with $” ?

jc

6

In screenshot you posted, there is a user LEISZLER$ in field samaccountname. The username with at the end could cause your problem. Try to use username without .

1 Like
7

That is not the user name I passed via web interface login test, the user name I input there was : jricardo not LEISZLER$ , I think that is a issue or I’m doing something wrong in the configuration ( probably this is the case)

8

Are you sure this field contains your username?

9

how I can check that? I’m passing that user via web interface. Its a way to check the user I input on web is the one AD is getting?

jc

logintest
logintest1293×569 52 KB

10

You can contact with your AD administrator, or check in the AD by yourself.

11

  1. Try to change your Search Base DN to: DC=lan,DC=leizler,DC=org. Because you try to search users with group membership, which is in higher ldap tree level, which couldn’t work.

  2. Check if you use right group path for LDAP. Graylog is normal group right into domain, or is it in normal Users OU? Normal groups are situated in OU Users, so in this situation, correct path will be: memberOf=CN=Graylog,CN=Users,DC=lan,DC=leiszler,DC=org

  3. Try to use this LDAP filter, which filter only real user accounts and not mail contacts:
    (&(objectCategory=person)(objectClass=user)(sAMAccountName={0})(memberOf=CN=Graylog,DC=lan,DC=leiszler,DC=org)))

  4. Try to use username with format: username@leizler.org

12

Thanks I will try your advice !

jc

13

weird , when I tried on Web interface use user@domain on Login Test this is what happens
Same if using lan\user
using the username only the error clears.( see below)

GLError
GLError1766×710 461 KB

GLError1
GLError11139×795 124 KB

So GL have not issues finding the AD User, I think the issue is in the authentication process, this is a new error!

MessageType : BIND_RESPONSE
Message ID : 10
    BindResponse
        Ldap Result
            Result code : (INVALID_CREDENTIALS) invalidCredentials
            Matched Dn : ''
            Diagnostic message : '80090308: LdapErr: DSID-0C090446, comment: AcceptSecurityContext error, data 52e, v2580'

GLError2
GLError21271×889 129 KB

14

SOLVED! using this:

GL ADUSERS
GL ADUSERS1204×714 121 KB

15

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.