# LDAP authentication issues

**URL:** <https://forum.ansible.com/t/ldap-authentication-issues/28973>\
**Category:** AWX Project\
**Created:** [November 8, 2018, 8:12am UTC](https://forum.ansible.com/t/ldap-authentication-issues/28973 "2018-11-08T08:12:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [November 8, 2018, 8:12am UTC](https://forum.ansible.com/t/ldap-authentication-issues/28973/1 "2018-11-08T08:12:56Z")

</div>

I am having issues integration with LDAP/AD. LDAP bind functions. When I don’t specify “LDAP Require Group” I can authenticate a user against LDAP/AD. So I assume that my user search/DN template settings are correct. I see the following errors in awx\_web log.

2018-11-08 07:24:57,771 DEBUG django\_auth\_ldap search\_s(‘DC=global,DC=corp,DC=sap’, 2, ‘(&(objectClass=group)(member=cn=d069683,ou=d,ou=identities,dc=global,dc=corp,dc=sap))’) returned 106 objects:

2018-11-08 07:27:47,348 DEBUG django\_auth\_ldap search\_s(‘OU=D,OU=Identities,DC=global,DC=corp,DC=’, 2, ‘(sAMAccountName=%(user)s)’) returned 1 objects: cn=,ou=d,ou=identities,dc=global,dc=corp,dc=domain  
2018-11-08 07:27:47,358 WARNING django\_auth\_ldap Caught LDAPError while authenticating : REFERRAL({‘info’: ‘Referral:\nldap://corp.global./dn=automation\_admin,ou=cloudms,ou=resources,dc=corp,dc=global,dc=’, ‘desc’: ‘Referral’},)

My settings are:

LDAP User DN Template -

LDAP Group Type - MemberDNGroupType

LDAP Require Group - DN=AUTOMATION\_ADMIN,OU=CLOUDMS,OU=Resources,DC=corp,DC=global,DC=

LDAP Deny Group -

LDAP Start TLS - Off

LDAP User Search -

[

“OU=D,OU=Identities,DC=global,DC=corp,DC=”,

“SCOPE\_SUBTREE”,

“(sAMAccountName=%(user)s)”

]

LDAP Group Search -

[

“DC=global,DC=corp,DC=”,

“SCOPE\_SUBTREE”,

“(objectClass=group)”

]

LDAP User Attribute Map -

{

“first\_name”: “givenName”,

“last\_name”: “sn”,

“email”: “mail”

}

---

<div class="post-metadata">

**Author:** ![Amir\_SBOUI](https://avatars.discourse-cdn.com/v4/letter/a/e95f7d/32.png) [@Amir\_SBOUI](https://forum.ansible.com/u/Amir_SBOUI)\
**Post date:** [November 9, 2018, 1:51pm UTC](https://forum.ansible.com/t/ldap-authentication-issues/28973/2 "2018-11-09T13:51:50Z")

</div>

Hi,  
have tried [disabling referrals](https://docs.ansible.com/ansible-tower/latest/html/administration/ldap_auth.html#referrals) ?

---

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [November 10, 2018, 6:23am UTC](https://forum.ansible.com/t/ldap-authentication-issues/28973/3 "2018-11-10T06:23:12Z")

</div>

It turns out the issue was nothing more than a wrong DN structure,  
getting my DC=.. in the wrong order. It worked without disabling  
referrals.