# AD authentification

**URL:** <https://forum.ansible.com/t/ad-authentification/34607>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [February 11, 2021, 11:49am UTC](https://forum.ansible.com/t/ad-authentification/34607 "2021-02-11T11:49:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yan](https://avatars.discourse-cdn.com/v4/letter/y/3e96dc/32.png) [@Yan](https://forum.ansible.com/u/Yan)\
**Post date:** [February 11, 2021, 11:49am UTC](https://forum.ansible.com/t/ad-authentification/34607/1 "2021-02-11T11:49:44Z")

</div>

Hi,

I do not manage to connect to our AD.

I 've got this in our LDAP conf (See screenshot).

Is there anything else to do to connect our AD users on AWX ?

When I do this:

$\> ldapsearch -H ldap://our\_AD:389 -x -D “admin@our\_AD” -b “dc=A,dc=D” “(sAMAccountName=awx)” -w PASSWORD

I’ve got a resut that shows it’s connecting well.

Any idea ??

Regards

Yan

> **(attachments)**
>
> ![0.PNG](https://us1.discourse-cdn.com/ansible/original/2X/1/1c213fa52cbd5bb1a50715c2f3ce65d18ea0a057.png)

---

<div class="post-metadata">

**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\
**Post date:** [February 11, 2021, 12:11pm UTC](https://forum.ansible.com/t/ad-authentification/34607/2 "2021-02-11T12:11:53Z")

</div>

Check your awx\_Web container it will give you the errors. If you can give us the logs then we can help you

---

<div class="post-metadata">

**Author:** ![Yan](https://avatars.discourse-cdn.com/v4/letter/y/3e96dc/32.png) [@Yan](https://forum.ansible.com/u/Yan)\
**Post date:** [February 19, 2021, 9:18am UTC](https://forum.ansible.com/t/ad-authentification/34607/3 "2021-02-19T09:18:03Z")

</div>

Hi,

Thx a lot for your answer.

I did it and this is what I obtain:

2021-02-19 09:10:23,009 DEBUG django\_auth\_ldap Authentication failed for awx@XXXXX: user DN/password rejected by LDAP server.  
2021-02-19 09:10:23,085 WARNING awx.api.generics Login failed for user awx@XXXX from Y.Y.Y.Y  
2021-02-19 09:10:23,090 WARNING django.request Unauthorized: /api/login/  
2021-02-19 09:10:23,090 WARNING django.request Unauthorized: /api/login/

Here bellow the exact structure of infos I’m using (I just replaced the real infos with generic ones).

I also checked and the user awx is correctly defined into the AD.

{  
“AUTH\_LDAP\_SERVER\_URI”: “ldap://chd-dc1.office.chd”,  
“AUTH\_LDAP\_BIND\_DN”: “CN=Admin,OU=XXX,OU=YYY,DC=domain,DC=com”,  
“AUTH\_LDAP\_BIND\_PASSWORD”: “$encrypted$”,  
“AUTH\_LDAP\_START\_TLS”: false,  
“AUTH\_LDAP\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_USER\_DN\_TEMPLATE”: “uid=%(user)s,OU=Users,DC=doamin,DC=com”,  
“AUTH\_LDAP\_USER\_ATTR\_MAP”: {  
“first\_name”: “givenname”,  
“last\_name”: “sn”,  
“email”: “mail”  
},  
“AUTH\_LDAP\_GROUP\_SEARCH”: [  
“dc=domain,dc=com”,  
“SCOPE\_SUBTREE”,  
“(objectClass=group)”  
],  
“AUTH\_LDAP\_GROUP\_TYPE”: “ActiveDirectoryGroupType”,  
“AUTH\_LDAP\_GROUP\_TYPE\_PARAMS”: {  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_1\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_1\_BIND\_DN”: “”,  
“AUTH\_LDAP\_1\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_1\_START\_TLS”: false,  
“AUTH\_LDAP\_1\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_1\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_1\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_1\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_1\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_1\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_1\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_1\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_1\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_1\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_1\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_1\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_2\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_2\_BIND\_DN”: “”,  
“AUTH\_LDAP\_2\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_2\_START\_TLS”: false,  
“AUTH\_LDAP\_2\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_2\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_2\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_2\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_2\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_2\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_2\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_2\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_2\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_2\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_2\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_2\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_3\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_3\_BIND\_DN”: “”,  
“AUTH\_LDAP\_3\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_3\_START\_TLS”: false,  
“AUTH\_LDAP\_3\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_3\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_3\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_3\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_3\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_3\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_3\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_3\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_3\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_3\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_3\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_3\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_4\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_4\_BIND\_DN”: “”,  
“AUTH\_LDAP\_4\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_4\_START\_TLS”: false,  
“AUTH\_LDAP\_4\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_4\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_4\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_4\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_4\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_4\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_4\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_4\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_4\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_4\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_4\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_4\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_5\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_5\_BIND\_DN”: “”,  
“AUTH\_LDAP\_5\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_5\_START\_TLS”: false,  
“AUTH\_LDAP\_5\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_5\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_5\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_5\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_5\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_5\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_5\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_5\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_5\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_5\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_5\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_5\_TEAM\_MAP”: {}  
}

Can you tell me what’s going wrong ?

Thx in advance.

---

<div class="post-metadata">

**Author:** ![sebastien\_chanson](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@sebastien\_chanson](https://forum.ansible.com/u/sebastien_chanson)\
**Post date:** [February 19, 2021, 12:30pm UTC](https://forum.ansible.com/t/ad-authentification/34607/4 "2021-02-19T12:30:51Z")

</div>

Hi,

I am not an expert on ldap but looking at your setup compared to mine I have the LDAP User Attribute Map filled with something like this:  
{  
“first\_name”: “givenName”,  
“last\_name”: “sn”,  
“email”: “mail”  
}  
I recall having trouble with ldap before filling this field.