# LDAP loguin not working
**URL:** https://community.graylog.org/t/ldap-loguin-not-working/15432
**Category:** Graylog Central (peer support)
**Created:** [May 13, 2020, 4:55pm UTC](https://community.graylog.org/t/ldap-loguin-not-working/15432 "2020-05-13T16:55:08Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ndelle](https://community.graylog.org/u/ndelle)
#### Post date: [May 13, 2020, 4:55pm UTC](https://community.graylog.org/t/ldap-loguin-not-working/15432/1 "2020-05-13T16:55:08Z")
Hi! I have been reading about this issue but i can’t make it work.
I have my LDAP configuration set, the test via Test Server Connetion button is working fine, and when i look for user in the Login Test area i get a User Found (OK) but when the user tries to login is getting a “Invalid Credentials, please verify them and retry”. The strange thing is that i am loged with my AD user and password without issues.
Do i have to create the user in the Authentication -\> Users area? Or should it create by itself with the first login?
My graylog version is v3.2.1.
Do you need any other information?
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [May 13, 2020, 5:38pm UTC](https://community.graylog.org/t/ldap-loguin-not-working/15432/2 "2020-05-13T17:38:32Z")
Please post your LDAP configuration in Graylog…
---
### Author:  [@ndelle](https://community.graylog.org/u/ndelle)
#### Post date: [May 13, 2020, 6:02pm UTC](https://community.graylog.org/t/ldap-loguin-not-working/15432/3 "2020-05-13T18:02:09Z")
Here goes. Group mapping is empty, and the server address is the real one in my config.
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [May 14, 2020, 1:50pm UTC](https://community.graylog.org/t/ldap-loguin-not-working/15432/4 "2020-05-14T13:50:03Z")
1. If you use `Active Directory` and not normal LDAP (like OpenLDAP), change `Server Type` to `Active Directory`
2. If you care about security always use secure connection to LDAP server, otherwise all password are send with plain text. Check `SSL` or `StartTLS` based of type your LDAP support, and change port to `636`
3. Check if your `Search Base DN` contains also your `System Username` bind and your users, better is to use lower LDAP tree structure, for example `DC=domain,DC=net`
4. Your User Search Pattern doesn’t use filter only for users, so it can include also another objects like groups, mail accounts and so on. Use rather filter like this which include user members of group Graylog\_users:
`(&(objectCategory=person)(objectClass=user)(sAMAccountName={0})(memberOf:CN=Graylog_users,DC=domain,DC=net)))`
5. I always try to use filter using AD mmc filter or powershell to check if it works, only remove part `(sAMAccountName={0})`
[https://theitbros.com/ldap-query-examples-active-directory/](https://theitbros.com/ldap-query-examples-active-directory/)
Hope it helps
---
### Author:  [@ndelle](https://community.graylog.org/u/ndelle)
#### Post date: [May 15, 2020, 4:35pm UTC](https://community.graylog.org/t/ldap-loguin-not-working/15432/5 "2020-05-15T16:35:04Z")
Its working now, thanks!
I changed to Active Directory (1) and changed the Search Base DN (3) to a wider OU.
About 4 i changed to the one you proposed but didnt work, i used the one that was already configured, and i will check the article in depth because i now little about the AD service and the queries.
Thanks for the information and the assistance.
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [May 29, 2020, 4:41pm UTC](https://community.graylog.org/t/ldap-loguin-not-working/15432/6 "2020-05-29T16:41:51Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.