# Questions about the use/debugging of ldap

**URL:** <https://forum.ansible.com/t/questions-about-the-use-debugging-of-ldap/3844>\
**Category:** Get Help\
**Tags:** awx\
**Created:** [February 13, 2024, 10:59am UTC](https://forum.ansible.com/t/questions-about-the-use-debugging-of-ldap/3844 "2024-02-13T10:59:32Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 13, 2024, 10:59am UTC](https://forum.ansible.com/t/questions-about-the-use-debugging-of-ldap/3844/1 "2024-02-13T10:59:32Z")

</div>

Hello again!  
Im testting to set up the userlogin for the AWX Webgui.  
I created a user wich can read the folder(ou) with ldapsearch, but i cant login in the webgui.  
I use a own awx user group to limit the acces for the administration and added my regular user in this group for testing, but i cant login in the web gui.  
Tried: domain.local\user | domain\user | user@domain.local | user@domain  
Do i have to configure someting else too?  
And how can i see the logs?  
I set the logging in the sytem logging to debug.  
I thought probably at Jobs but nothing this related to see.  
Do i have to set up a logging server?

 ![grafik](https://us1.discourse-cdn.com/ansible/original/2X/c/c87f7bae39dad10d07137bcc000944febd6b2c34.png)

Thank you again for your input!!

---

<div class="post-metadata">

**Author:** ![j-oss2023](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/j-oss2023/32/2260_2.png) [@j-oss2023](https://forum.ansible.com/u/j-oss2023)\
**Post date:** [February 13, 2024, 11:15am UTC](https://forum.ansible.com/t/questions-about-the-use-debugging-of-ldap/3844/2 "2024-02-13T11:15:48Z")

</div>

Try these settings, Works for us… Using Microsoft Active Directory as LDAP server…

LDAP Server URI

```json
ldap://100.100.100.100

```

LDAP Bind DN (user to authenticate with LDAP)

```json
CN=Service Account,OU=Service,OU=Accounts,DC=example,DC=domain,DC=com

```

LDAP Group Type

```json
MemberDNGroupType

```

LDAP User Search (where the users live)

```json
[
  "OU=Users,OU=Accounts,DC=example,DC=domain,DC=com",
  "SCOPE_SUBTREE",
  "(sAMAccountName=%(user)s)"
]

```

LDAP Group Search (where the groups live)

```json
[
  "OU=Accounts,DC=example,DC=domain,DC=com",
  "SCOPE_SUBTREE",
  "(objectClass=group)"
]

```

LDAP User Attribute Map (use this, maps correctly the LDAP to AWX attrs)

```json
{
  "email": "mail",
  "first_name": "givenName",
  "last_name": "sn"
}

```

LDAP Group Type Parameters (dunno, it works)

```json
{
  "member_attr": "member",
  "name_attr": "cn"
}

```

LDAP User Flags By Group

```json
{
  "is_superuser": [
    "CN=AWX Admins,OU=Accounts,DC=example,DC=domain,DC=com",
  ]
}

```

LDAP Organization Map (anyone in this group will be part of “Engineering” team in AWX )

```json
{
  "Engineering": {
    "admins": "CN=AWX Admins,OU=Accounts,DC=example,DC=domain,DC=com",
    "remove_admins": false,
    "remove_users": false,
    "users": true
  }
}

```

LDAP Team Map

```json
{}

```

---

<div class="post-metadata">

**Author:** ![j-oss2023](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/j-oss2023/32/2260_2.png) [@j-oss2023](https://forum.ansible.com/u/j-oss2023)\
**Post date:** [February 13, 2024, 11:25am UTC](https://forum.ansible.com/t/questions-about-the-use-debugging-of-ldap/3844/3 "2024-02-13T11:25:26Z")

</div>

Oh and then finally,

Login with the username…

not email, not @example.domain.local

just their User logon name, ie “bob”

 ![Screenshot 2024-02-13 at 10.24.45 pm](https://us1.discourse-cdn.com/ansible/original/2X/4/44ab68c32bcd9282bacecd22156d9fb12cb12250.png)

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 13, 2024, 11:59am UTC](https://forum.ansible.com/t/questions-about-the-use-debugging-of-ldap/3844/4 "2024-02-13T11:59:41Z")

</div>

only the user was the first i tried - the only diffrece was i had this user DN Template too much - i deleted it.  
And the added group filter.  
Is the login then possible without further configs?

---

<div class="post-metadata">

**Author:** ![j-oss2023](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/j-oss2023/32/2260_2.png) [@j-oss2023](https://forum.ansible.com/u/j-oss2023)\
**Post date:** [February 13, 2024, 12:04pm UTC](https://forum.ansible.com/t/questions-about-the-use-debugging-of-ldap/3844/5 "2024-02-13T12:04:14Z")

</div>

No further config is needed, at least in our environment…

Making sure the LDAP server is accessible from the AWX machine

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 13, 2024, 12:07pm UTC](https://forum.ansible.com/t/questions-about-the-use-debugging-of-ldap/3844/6 "2024-02-13T12:07:44Z")

</div>

Yeah Thank you!

 ![grafik](https://us1.discourse-cdn.com/ansible/original/2X/8/81f1e7489f41c02bf74480405fe0c5ba5bdac4b0.png)  
The chatbot lured me again to the error - ill get the feeling i should stop stink it - read the manual and ask rather here.  
Would be quicker i think.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [March 14, 2024, 12:27pm UTC](https://forum.ansible.com/t/questions-about-the-use-debugging-of-ldap/3844/8 "2024-03-14T12:27:11Z")

</div>

Closed on March 14, 2024, 12:27pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.