# LDAP authentication without using group

**URL:** <https://community.graylog.org/t/ldap-authentication-without-using-group/1565>\
**Category:** Graylog Central (peer support)\
**Created:** [June 27, 2017, 7:39am UTC](https://community.graylog.org/t/ldap-authentication-without-using-group/1565 "2017-06-27T07:39:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jtkarvo](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jtkarvo](https://community.graylog.org/u/jtkarvo)\
**Post date:** [June 27, 2017, 7:39am UTC](https://community.graylog.org/t/ldap-authentication-without-using-group/1565/1 "2017-06-27T07:39:48Z")

</div>

hi,

I am trying to make LDAP authentication work so that all users are administered in the Graylog (no Groups setting used).

The LDAP connection works OK, and the login test works.

I did not find information on how to create a user that authenticates to the directory though. What attribute does Graylog use as user name when authenticating? (i.e. what user name should I use so that it matches with the one LDAP returns for the query?)

The error message I get, when I try (account name removed):

```
2017-06-27T10:28:38.455+03:00 WARN [ModularRealmAuthenticator] Realm [org.graylog2.security.realm.PasswordAuthenticator@347626d4] threw an exception during a multi-realm authentication attempt: org.apache.shiro.authc.IncorrectCredentialsException: Submitted credentials for token [org.apache.shiro.authc.UsernamePasswordToken - ******* , rememberMe=false] did not match the expected credentials.
2017-06-27T10:28:38.456+03:00 INFO [SessionsResource] Invalid username or password for user " *******"
```

---

<div class="post-metadata">

**Author:** ![jtkarvo](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jtkarvo](https://community.graylog.org/u/jtkarvo)\
**Post date:** [June 28, 2017, 9:09am UTC](https://community.graylog.org/t/ldap-authentication-without-using-group/1565/2 "2017-06-28T09:09:52Z")

</div>

… found it. My problem was in the provider order settings; LDAP was disabled there, even when I enabled in the LDAP settings page.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 12, 2017, 9:10am UTC](https://community.graylog.org/t/ldap-authentication-without-using-group/1565/3 "2017-07-12T09:10:14Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.