Troubleshooting LDAP authentication
Local users and LDAP users
Make sure that existing local users in Factry Historian/Grafana have a different username than the one used for LDAP authentication. If the username of the local user is the same as the LDAP user, when enabling the group mapping in Factry Historian/Grafana, the permissions (groups of the local user in Factry Historian/Grafana) will be synchronised with LDAP too.
Case sensitivity (Capital vs Small letters)
LDAP is case insensitive by default, but that setting can be overwritten in your LDAP server or even per LDAP group. Make sure to use the exact same DN in the Factry Historian/Grafana configuration as listed in the LDAP server.
Time-out error (Grafana) or grey authentication provider icon (Factry Historian)
Occurs in one of the following cases. On saving the LDAP configuration:
- in Factry Historian, the authentication provider icon stays grey (no green nor red)
- in Grafana, a time-out error is received
If the LDAP host is a DNS name, replace it with an ip address or make sure the DNS name can be found by the Historian server. If the LDAP host is an ip address, make sure the ip address can be found by the Historian server.
Red Authentication provider icon (Factry Historian)
Double check the configuration (attention to host and port)! Look for an error in Configuration > Application logs and/or get in touch with Factry support.
Root CA certificate, client certificate and client key
Manage files
Put the files on the Historian server. Copy the files to a good-practice directory and set the according file privileges for the respected users (e.g. factry-system-user needs read rights on these files).
cp root-ca-certificate.crt /etc/ssl/factry/
cp client-certificate.crt /etc/ssl/factry
cp client-key.key /etc/ssl/factry
cd /etc/ssl/factry
chmod 644 root-ca-certificate.crt
chmod 644 client-certificate.crt
chmod 640 client-key.key
chown root:factry-system-user root-ca-certificate.crt
chown root:factry-system-user client-certificate.crt
chown root:factry-system-user client-key.key A help command to read a certificate as text to see the content:
openssl x509 -in root-ca-certificate.crt -text -nooutRoot CA unreachable from Historian server
When the Root CA can not be reached from the Historian server, the Root CA certificate has to be copied to the Historian server and the path added in the LDAP configuration.
Group mapping
Users are not matched against a LDAP subgroup
For a group mapping in Factry Historian/Grafana, the DN configured only grants permissions to the users in the matched LDAP group(s). It does not grant permissions to users in a subgroup of the matched LDAP group(s).
Missing privileges in Factry Historian
If you log out and try to log in with a LDAP user (with a username that does not exist in Factry Historian), a error will be thrown (click the question mark on the error):
This means the user is authenticated (login succeeds) but the user is not authorized to do any action (can't see anything) since it's not part of a group in Factry Historian. To give permissions to the user, there are 2 options:
- Manually manage the groups that the user is part of: see Users & User Groups