Hi,
I am setting up Grafana 5.2.1 in my lab to use as backed for Elasticsearch datasource.
But I am facing issue in configuring LDAP authentication. I have configured ldap with default setting but getting belwo error:
t=2018-07-24T09:01:17-0700 lvl=eror msg=“Invalid username or password” logger=context userId=0 orgId=0 uname= error=“Invalid Username or Password”
t=2018-07-24T09:01:17-0700 lvl=info msg=“Request Completed” logger=context userId=0 orgId=0 uname= method=POST path=/login status=401 remote_addr=10.115.248.139 time_ms=40 size=42 referer=http://lXXXXXXXXX:3000/login
Below is my ldap config:
verbose_logging = true
[[servers]]
host = “abc.xyz.com”
port = 636
use_ssl = true
start_tls = false
ssl_skip_verify = true
root_ca_cert = “/path/to/certificate.crt”
bind_dn = “cn=%s,ou=XXX,ou=XXX,dc=XXX,dc=xyz,dc=com”
search_filter = “(sAMAccountName=%s)”
search_base_dns = [“dc=XXX,dc=XYZ,dc=com”]
In POSIX LDAP schemas, without memberOf attribute a secondary query must be made for groups.
This is done by enabling group_search_filter below. You must also set member_of= “cn”
in [servers.attributes] below.
Users with nested/recursive group membership and an LDAP server that supports LDAP_MATCHING_RULE_IN_CHAIN
can set group_search_filter, group_search_filter_user_attribute, group_search_base_dns and member_of
below in such a way that the user’s recursive group membership is considered.
Nested Groups + Active Directory (AD) Example:
AD groups store the Distinguished Names (DNs) of members, so your filter must
recursively search your groups for the authenticating user’s DN. For example:
group_search_filter = “(member:1.2.840.113556.1.4.1941:=%s)”
group_search_filter_user_attribute = “distinguishedName”
group_search_base_dns = [“ou=groups,dc=grafana,dc=org”]
[servers.attributes]
…
member_of = “distinguishedName”
Group search filter, to retrieve the groups of which the user is a member (only set if memberOf attribute is not available)
group_search_filter = “(&(objectClass=posixGroup)(memberUid=%s))”
Group search filter user attribute defines what user attribute gets substituted for %s in group_search_filter.
Defaults to the value of username in [server.attributes]
Valid options are any of your values in [servers.attributes]
If you are using nested groups you probably want to set this and member_of in
[servers.attributes] to “distinguishedName”
group_search_filter_user_attribute = “distinguishedName”
An array of the base DNs to search through for groups. Typically uses ou=groups
group_search_base_dns = [“ou=groups,dc=grafana,dc=org”]
Specify names of the ldap attributes your ldap uses
[servers.attributes]
name = “givenName”
surname = “sn”
username = “cn”
member_of = “memberOf”
email = “email”
Map ldap groups to grafana org roles
[[servers.group_mappings]]
group_dn = “cn=admins,dc=grafana,dc=org”
org_role = “Admin”
The Grafana organization database id, optional, if left out the default org (id 1) will be used
org_id = 1
[[servers.group_mappings]]
group_dn = “cn=users,dc=grafana,dc=org”
org_role = “Editor”
[[servers.group_mappings]]
If you want to match all (or no ldap groups) then you can use wildcard
group_dn = “*”
org_role = “Viewer”
LDAP config in grafana.ini
#################################### Auth LDAP ##########################
[auth.ldap]
enabled = true
config_file = /etc/grafana/ldap.toml
allow_sign_up = true
can you please help me resolving this.