# AWX Authenticating to Windows AD error

**URL:** <https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291>\
**Category:** AWX Project\
**Tags:** windows, awx\
**Created:** [September 16, 2019, 6:37pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291 "2019-09-16T18:37:21Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Meyer1](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@Andrew\_Meyer1](https://forum.ansible.com/u/Andrew_Meyer1)\
**Post date:** [September 16, 2019, 6:37pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/1 "2019-09-16T18:37:21Z")

</div>

Hello,  
I am seem to be getting an error when trying to test users logging into AWX from Microsoft AD.

My configuration for LDAP is below

`

{  
“AUTH\_LDAP\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_BIND\_DN”: “”,  
“AUTH\_LDAP\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_START\_TLS”: false,  
“AUTH\_LDAP\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_GROUP\_TYPE\_PARAMS”: {  
“name\_attr”: “cn”,  
“member\_attr”: “member”  
},  
“AUTH\_LDAP\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_1\_SERVER\_URI”: “ldap://10.150.10.150:389”,  
“AUTH\_LDAP\_1\_BIND\_DN”: “CN=ansible1,OU=automation,DC=ad,dc=example,DC=local”,  
“AUTH\_LDAP\_1\_BIND\_PASSWORD”: “$encrypted$”,  
“AUTH\_LDAP\_1\_START\_TLS”: false,  
“AUTH\_LDAP\_1\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_1\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_1\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_1\_USER\_ATTR\_MAP”: {  
“first\_name”: “givenName”,  
“last\_name”: “sn”,  
“email”: “userPrincipalName”  
},  
“AUTH\_LDAP\_1\_GROUP\_SEARCH”: [  
“CN=ansible-tower,OU=Users,DC=ad,DC=example,DC=local”,  
“SCOPE\_SUBTREE”,  
“(objectClass=groupOfNames)”  
],  
“AUTH\_LDAP\_1\_GROUP\_TYPE”: “ActiveDirectoryGroupType”,  
“AUTH\_LDAP\_1\_GROUP\_TYPE\_PARAMS”: {},  
“AUTH\_LDAP\_1\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_1\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_1\_USER\_FLAGS\_BY\_GROUP”: {  
“is\_superuser”: [  
“cn=ansible-tower,OU=Users,DC=ad,DC=example,DC=local”  
]  
},  
“AUTH\_LDAP\_1\_ORGANIZATION\_MAP”: {  
“TSG”: {  
“users”: [  
“CN=ansible-tower-users,CN=Users,DC=ad,DC=example,DC=local”  
],  
“admins”: [  
“CN=ansible-tower-admins,CN=Users,DC=ad,DC=example,DC=local”  
],  
“remove\_users”: false,  
“remove\_admins”: false  
}  
},  
“AUTH\_LDAP\_1\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_2\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_2\_BIND\_DN”: “”,  
“AUTH\_LDAP\_2\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_2\_START\_TLS”: false,  
“AUTH\_LDAP\_2\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_2\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_2\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_2\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_2\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_2\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_2\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_2\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_2\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_2\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_2\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_2\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_3\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_3\_BIND\_DN”: “”,  
“AUTH\_LDAP\_3\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_3\_START\_TLS”: false,  
“AUTH\_LDAP\_3\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_3\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_3\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_3\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_3\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_3\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_3\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_3\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_3\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_3\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_3\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_3\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_4\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_4\_BIND\_DN”: “”,  
“AUTH\_LDAP\_4\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_4\_START\_TLS”: false,  
“AUTH\_LDAP\_4\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_4\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_4\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_4\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_4\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_4\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_4\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_4\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_4\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_4\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_4\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_4\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_5\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_5\_BIND\_DN”: “”,  
“AUTH\_LDAP\_5\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_5\_START\_TLS”: false,  
“AUTH\_LDAP\_5\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_5\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_5\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_5\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_5\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_5\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_5\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_5\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_5\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_5\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_5\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_5\_TEAM\_MAP”: {}  
}

`

I am getting the following error in the web docker instance.

`

2019-09-16 18:35:13,694 WARNING django\_auth\_ldap AUTH\_LDAP\_USER\_SEARCH must be an LDAPSearch instance. while authenticating ellen.ripley  
2019-09-16 18:35:13,695 ERROR awx.sso.backends Encountered an error authenticating to LDAP  
Traceback (most recent call last):  
File “/var/lib/awx/venv/awx/lib64/python3.6/site-packages/awx/sso/backends.py”, line 128, in authenticate  
return super(LDAPBackend, self).authenticate(request, username, password)  
File “/var/lib/awx/venv/awx/lib64/python3.6/site-packages/django\_auth\_ldap/backend.py”, line 150, in authenticate  
user = self.authenticate\_ldap\_user(ldap\_user, password)  
File “/var/lib/awx/venv/awx/lib64/python3.6/site-packages/django\_auth\_ldap/backend.py”, line 210, in authenticate\_ldap\_user  
return ldap\_user.authenticate(password)  
File “/var/lib/awx/venv/awx/lib64/python3.6/site-packages/django\_auth\_ldap/backend.py”, line 348, in authenticate  
self.\_authenticate\_user\_dn(password)  
File “/var/lib/awx/venv/awx/lib64/python3.6/site-packages/django\_auth\_ldap/backend.py”, line 471, in \_authenticate\_user\_dn  
if self.dn is None:  
File “/var/lib/awx/venv/awx/lib64/python3.6/site-packages/django\_auth\_ldap/backend.py”, line 436, in dn  
self.\_load\_user\_dn()  
File “/var/lib/awx/venv/awx/lib64/python3.6/site-packages/django\_auth\_ldap/backend.py”, line 509, in \_load\_user\_dn  
self.\_user\_dn = self.\_search\_for\_user\_dn()  
File “/var/lib/awx/venv/awx/lib64/python3.6/site-packages/django\_auth\_ldap/backend.py”, line 529, in \_search\_for\_user\_dn  
raise ImproperlyConfigured(‘AUTH\_LDAP\_USER\_SEARCH must be an LDAPSearch instance.’)  
django.core.exceptions.ImproperlyConfigured: AUTH\_LDAP\_USER\_SEARCH must be an LDAPSearch instance.  
2019-09-16 18:35:13,939 WARNING awx.api.generics Login failed for user ellen.ripley from 10.150.1.155  
2019-09-16 18:35:13,960 WARNING django.request Unauthorized: /api/login/  
2019-09-16 18:35:13,960 WARNING django.request Unauthorized: /api/login/

`

Thoughts?

---

<div class="post-metadata">

**Author:** ![Mike\_Charchuk](https://avatars.discourse-cdn.com/v4/letter/m/e47774/32.png) [@Mike\_Charchuk](https://forum.ansible.com/u/Mike_Charchuk)\
**Post date:** [September 16, 2019, 7:12pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/2 "2019-09-16T19:12:45Z")

</div>

I have the User search base defined in my config AUTH\_LDAP\_USER\_SEARCH

---

<div class="post-metadata">

**Author:** ![Andrew\_Meyer1](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@Andrew\_Meyer1](https://forum.ansible.com/u/Andrew_Meyer1)\
**Post date:** [September 17, 2019, 2:26am UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/3 "2019-09-17T02:26:09Z")

</div>

Could you share what you have for your ldap\_user\_search omitting the sensitive information? Replace it with [example.org](http://example.org) or something.

---

<div class="post-metadata">

**Author:** ![Mike\_Charchuk](https://avatars.discourse-cdn.com/v4/letter/m/e47774/32.png) [@Mike\_Charchuk](https://forum.ansible.com/u/Mike_Charchuk)\
**Post date:** [September 17, 2019, 3:31pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/4 "2019-09-17T15:31:58Z")

</div>

[  
“OU=Users,DC=example,DC=com”,  
“SCOPE\_SUBTREE”,  
“(sAMAccountName=%(user)s)”  
]

---

<div class="post-metadata">

**Author:** ![Andrew\_Meyer1](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@Andrew\_Meyer1](https://forum.ansible.com/u/Andrew_Meyer1)\
**Post date:** [September 17, 2019, 3:45pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/5 "2019-09-17T15:45:09Z")

</div>

That’s what I had at one point. It still complained.

---

<div class="post-metadata">

**Author:** ![Mike\_Charchuk](https://avatars.discourse-cdn.com/v4/letter/m/e47774/32.png) [@Mike\_Charchuk](https://forum.ansible.com/u/Mike_Charchuk)\
**Post date:** [September 17, 2019, 4:21pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/6 "2019-09-17T16:21:41Z")

</div>

The only differences from mine

Instead of groupofnames I just use group in the group search.

I do use a auth\_ldap\_require\_group

Auth\_ldap\_group\_type is GroupOfNamesType

---

<div class="post-metadata">

**Author:** ![Mike\_Charchuk](https://avatars.discourse-cdn.com/v4/letter/m/e47774/32.png) [@Mike\_Charchuk](https://forum.ansible.com/u/Mike_Charchuk)\
**Post date:** [September 17, 2019, 4:25pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/7 "2019-09-17T16:25:15Z")

</div>

There is a webinar on ldap config.fro ansible tower on the [ansible.com](http://ansible.com) site where it told me to make these changes via the api

Change:  
“AUTH\_LDAP\_CONNECTION\_OPTIONS”: {  
“OPT\_NETWORK\_TIMEOUT”: 30,  
“OPT\_REFERRALS”: 0  
},  
To:  
“AUTH\_LDAP\_CONNECTION\_OPTIONS”: {  
“OPT\_X\_TLS\_REQUIRE\_CERT”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30,  
“OPT\_X\_TLS\_NEWCTX”: 0,  
“OPT\_REFERRALS”: 0

---

<div class="post-metadata">

**Author:** ![Andrew\_Meyer1](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@Andrew\_Meyer1](https://forum.ansible.com/u/Andrew_Meyer1)\
**Post date:** [September 17, 2019, 4:42pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/8 "2019-09-17T16:42:51Z")

</div>

I added everything you suggested and i’m still getting access denied

Here is my config output from the API browser

`

{  
“AUTH\_LDAP\_SERVER\_URI”: “ldap://10.150.10.150:389”,  
“AUTH\_LDAP\_BIND\_DN”: “CN=ansible,OU=TSG,DC=ad,DC=example,DC=local”,  
“AUTH\_LDAP\_BIND\_PASSWORD”: “$encrypted$”,  
“AUTH\_LDAP\_START\_TLS”: false,  
“AUTH\_LDAP\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30,  
“OPT\_X\_TLS\_NEWCTX”: 0,  
“OPT\_X\_TLS\_REQUIRE\_CERT”: 0  
},  
“AUTH\_LDAP\_USER\_SEARCH”: [  
“OU=TSG,DC=ad,DC=example,DC=local”,  
“SCOPE\_SUBTREE”,  
“(sAMAccountName=%(user)s)”  
],  
“AUTH\_LDAP\_USER\_DN\_TEMPLATE”: “uid=(sAMAccountName=%(user)s),OU=TSG,DC=ad,DC=example,DC=local”,  
“AUTH\_LDAP\_USER\_ATTR\_MAP”: {  
“first\_name”: “givenName”,  
“last\_name”: “sn”,  
“email”: “userPrincipalName”  
},  
“AUTH\_LDAP\_GROUP\_SEARCH”: [  
“CN=ansible1,OU=TSG,DC=ad,DC=example,DC=local”,  
“SCOPE\_SUBTREE”,  
“(objectClass=groupOfNames)”  
],  
“AUTH\_LDAP\_GROUP\_TYPE”: “GroupOfNamesType”,  
“AUTH\_LDAP\_GROUP\_TYPE\_PARAMS”: {},  
“AUTH\_LDAP\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_USER\_FLAGS\_BY\_GROUP”: {  
“is\_superuser”: [  
“CN=ansible,OU=TSG,DC=ad,DC=example,DC=local”  
]  
},  
“AUTH\_LDAP\_ORGANIZATION\_MAP”: {  
“TSG”: {  
“users”: [  
“CN=ansible1,CN=Users,DC=ad,DC=example,DC=local”  
],  
“admins”: [  
“CN=ansible1,CN=Users,DC=ad,DC=example,DC=local”  
],  
“remove\_users”: false,  
“remove\_admins”: false  
}  
},

`

---

<div class="post-metadata">

**Author:** ![Uriel](https://avatars.discourse-cdn.com/v4/letter/u/53a042/32.png) [@Uriel](https://forum.ansible.com/u/Uriel)\
**Post date:** [September 17, 2019, 4:53pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/9 "2019-09-17T16:53:45Z")

</div>

Did the error message change when you made the changes @mike.charchuk suggested? I remember getting this setup was tough but the error messages on the web container were generally good at pointing me in the right direction.

I remember getting some log in errors and it turned out i needed to set the LDAPTLS\_REQCERT env variable to get it working right.

---

<div class="post-metadata">

**Author:** ![Andrew\_Meyer1](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@Andrew\_Meyer1](https://forum.ansible.com/u/Andrew_Meyer1)\
**Post date:** [September 17, 2019, 5:08pm UTC](https://forum.ansible.com/t/awx-authenticating-to-windows-ad-error/31291/10 "2019-09-17T17:08:23Z")

</div>

No. Unfortunately.