# LDAP authentication not working. **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [March 8, 2023, 3:18pm UTC](https://forum.ansible.com/t/ldap-authentication-not-working/37743 "2023-03-08T15:18:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mjksohonet](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mjksohonet/32/1217_2.png) [@mjksohonet](https://forum.ansible.com/u/mjksohonet)\ **Post date:** [March 8, 2023, 3:18pm UTC](https://forum.ansible.com/t/ldap-authentication-not-working/37743/1 "2023-03-08T15:18:10Z")
AWX 21.12.0 in a k3s cluster. I’m trying to configure AWX to authenticate users using LDAP. I’ve added the LDAP details to AWX and AWX is not complaining about any of them. However, when I try to login using a username that I know can be authenticated in LDAP, I can see no attempt to contact the LDAP server. How can I debug this? Thanks. ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [March 8, 2023, 4:44pm UTC](https://forum.ansible.com/t/ldap-authentication-not-working/37743/2 "2023-03-08T16:44:09Z")
usually the error is output in the awx\_web container logs. what does it say there? ---
**Author:** ![russell.cecala](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/russell.cecala/32/1028_2.png) [@russell.cecala](https://forum.ansible.com/u/russell.cecala)\ **Post date:** [March 9, 2023, 3:39am UTC](https://forum.ansible.com/t/ldap-authentication-not-working/37743/3 "2023-03-09T03:39:56Z")
I had trouble getting OpenLDAP to work with AWX too (turned out I was wrong about the password) but I hope this helps: Trouble Shooting LDAP Authentication with Ansible AWX If you are having trouble getting your AWX deployment to preform authentication with LDAP you might want to make sure that the container that runs the AWX web server can talk to the LDAP server over a encrypted connection. To do this follow these steps: 1. List your AWX pods like so: > kubectl -n awx get pods You are looking for the pod that has the 4 containers. In my case this is pod, _awx-demo-8ded6678-gk322_. 1. “exec” onto the awx-demo-web container like so: > kubectl -n awx exec -it _awx-demo-8ded6678-gk322_ -c awx-demo-web – /bin/bash 1. Check the secure connection to the LDAP server From the bash prompt on the container execute: > echo | openssl s\_client -connect [ldap.example.com:636](http://ldap.example.com:636) Check the output. Are you getting output? You can check the dates on the certificate like so: ---
**Author:** ![mjksohonet](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mjksohonet/32/1217_2.png) [@mjksohonet](https://forum.ansible.com/u/mjksohonet)\ **Post date:** [March 9, 2023, 9:18pm UTC](https://forum.ansible.com/t/ldap-authentication-not-working/37743/4 "2023-03-09T21:18:49Z")
The container can connect to the ldap server (a Debian 10 VM running ns-slapd) _bash-5.1$ echo | openssl s\_client -connect :636 2\>/dev/null | openssl x509 -noout -dates_ _notBefore=Jan 9 00:00:00 2023 GMT_ _notAfter=Jan 14 23:59:59 2024 GMT_ _bash-5.1$_ I found this is the logs _Traceback (most recent call last):_ _File “/var/lib/awx/venv/awx/lib64/python3.9/site-packages/awx/sso/backends.py”, line 119, in authenticate_ _raise ImproperlyConfigured(“{} must be an {} instance.”.format(setting\_name, type\_))_ _django.core.exceptions.ImproperlyConfigured: GROUP\_SEARCH must be an LDAPSearch instance._ _ERROR:awx.sso.backends:Encountered an error authenticating to LDAP_ I don’t have a group search defined but AWX doesn’t complain when I save a configuration with an empty group search list. Is that a bug? Imagine the following: Company: [example.com](http://example.com) AWX server: [awx.example.com](http://awx.example.com) LDAP server: [ldap.example.com](http://ldap.example.com) What would be the LDAP configuration to authenticate users in dn: cn= AWX Users,ou=Groups,dc=example,dc=com Thanks. ---
**Author:** ![russell.cecala](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/russell.cecala/32/1028_2.png) [@russell.cecala](https://forum.ansible.com/u/russell.cecala)\ **Post date:** [March 9, 2023, 9:49pm UTC](https://forum.ansible.com/t/ldap-authentication-not-working/37743/5 "2023-03-09T21:49:44Z")
I used: - " **LDAP Group Type"** to PosixGroupType Here is the second part of my write up … Trouble shooting AWX LDAP Authentication Issue I have a K3s cluster and I set up my AWX server by installing awx-operator. I also have an OpenLDAP server. My OpenLDAP server has a signed valid TLS Cert and works fine. Next I log on to my AWX server as the ‘admin’ user. > _You get the password for this account by executing:_ > kubectl get secret awx-demo-admin-password -o jsonpath={.data.password} | base64 --decode I navigate to " **Settings \> LDAP Default"** and filled out the form. Set: - " **LDAP Server URI"** to my ldap server ldaps://ldap.example.com. - **“LDAP Bind DN”** to cn=Manager,dc=example,dc=com - " **LDAP Bind Password"** to the correct password you would use with `ldapsearch`. - " **LDAP Group Type"** to PosixGroupType - **“LDAP User Search”** to [“ou=users,dc=example,dc=com”,“SCOPE\_SUBTREE”,“(uid=%(user)s)”] - **“LDAP Group Search”** to [“OU=Groups,dc=example,dc=com”,“SCOPE\_SUBTREE”,“(objectClass=posixGroup)”] Everything else leave as default. _Note: Of course I used my actual domain name and NOT [example.com](http://example.com)._ Then I tried to log into the AWX UI with my LDAP user account but couldn’t log in. I spent days reading documentation and try things. I even accidentally locked my admin account out by clicking on “Disable the built-in authentication system” Off link. **DO NOT DO THAT!** I had to run an update to a table in the postgresql database to fix that. Here is how I finally came to realize that I was entering the wrong password. I would “tail” the log of the “awx-demo-web” container with this command: kubectl -n awx get pods … kubectl -n logs -f awx-demo-9aidd-gk6dy awx-demo-web … and you will see messages like: WARNING … awx.api.generics Login failed for user red.cricket from 10.0.0.5 WARNING … django.request Unauthorized: /api/login/ WARNING … django.request Unauthorized: /api/login/ But nothing that will tell you why the login failed. To see why you need to change the logging level on the AWX server to DEBUG. And to do that you navigate to " **Settings \> Logging"** and click the **Edit** button, then change the “\*\*Logging Aggregator Level Threshold”\*\*to " **DEBUG"**. Then when you attempt to login with the wrong password you will see this output in the logs: DEBUG … django\_auth\_ldap search\_s(…) returned 1 objects: uid=red.cricket… DEBUG … django\_auth\_ldap Authentication failed for red.cricket: user DN/password rejected by LDAP server. Once you have figured out what is wrong and how to correct it be sure change the logging level back to INFO. ---
**Author:** ![mjksohonet](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mjksohonet/32/1217_2.png) [@mjksohonet](https://forum.ansible.com/u/mjksohonet)\ **Post date:** [March 10, 2023, 4:07pm UTC](https://forum.ansible.com/t/ldap-authentication-not-working/37743/6 "2023-03-10T16:07:48Z")
My bad. I had enabled TLS when I shouldn’t have. Thanks for the help.