LDAP auth not working after 4.2 update

I recently updated two Grafana instances to 4.2 and have not been able to authenticate users via LDAP since the update. I did notice that grafana.ini and ldap.toml were modified and my old files were saved. I have made the necessary modifications to those files to match my previous configuration and still no luck.The logs show the following error.

lvl=eror msg=“Invalid username or password” logger=context userId=0 orgId=0 uname= error=“Invalid Username or Password”

I verified that LDAP authentication was working prior to the update. Are you aware of any LDAP issues with the latest release?

Nothing to report to coincide with your error, but you can turn on the filter = ldap:debug under the [log] section in ldap.toml to get more detailed info. I don’t recall, but you may have to restart grafana-server.

my ldap auth work find.
Should have something wrong in your config
Could you post your config here?

Here is a copy of my ldap.toml file.

To troubleshoot and get more log info enable ldap debug logging in grafana.ini

filters = ldap:debug


Ldap server host (specify multiple hosts space separated)

host = “ad-server1 ad-server2”

Default port is 389 or 636 if use_ssl = true

port = 389

Set to true if ldap server supports TLS

use_ssl = false

Set to true if connect ldap server with STARTTLS pattern (create connection in insecure, then upgrade to secure connection with TLS)

start_tls = false

set to true if you want to skip ssl cert validation

ssl_skip_verify = false

set to the path to your root CA certificate or leave unset to use system defaults

root_ca_cert = /path/to/certificate.crt

Search user bind dn

bind_dn = “CN=srvcldapuser,OU=Service Accounts,OU=Internal,DC=something,DC=contosos,DC=net”

Search user bind password

If the password contains # or ; you have to wrap it with trippel quotes. Ex “”"#password;"""

bind_password = ‘LLjfaSLDfas0e’

User search filter, for example “(cn=%s)” or “(sAMAccountName=%s)” or “(uid=%s)”

search_filter = “(sAMAccountName=%s)”

An array of base dns to search through

search_base_dns = [“OU=Users,OU=Internal,DC=something,DC=contoso,DC=net”]

In POSIX LDAP schemas, without memberOf attribute a secondary query must be made for groups.

This is done by enabling group_search_filter below. You must also set member_of= “cn”

in [servers.attributes] below.

Users with nested/recursive group membership and an LDAP server that supports LDAP_MATCHING_RULE_IN_CHAIN

can set group_search_filter, group_search_filter_user_attribute, group_search_base_dns and member_of

below in such a way that the user’s recursive group membership is considered.

Nested Groups + Active Directory (AD) Example:

AD groups store the Distinguished Names (DNs) of members, so your filter must

recursively search your groups for the authenticating user’s DN. For example:

group_search_filter = “(member:1.2.840.113556.1.4.1941:=%s)”

group_search_filter_user_attribute = “distinguishedName”

group_search_base_dns = [“ou=groups,dc=grafana,dc=org”]


member_of = “distinguishedName”

Group search filter, to retrieve the groups of which the user is a member (only set if memberOf attribute is not available)

group_search_filter = “(&(objectClass=posixGroup)(memberUid=%s))”

Group search filter user attribute defines what user attribute gets substituted for %s in group_search_filter.

Defaults to the value of username in [server.attributes]

Valid options are any of your values in [servers.attributes]

If you are using nested groups you probably want to set this and member_of in

[servers.attributes] to “distinguishedName”

group_search_filter_user_attribute = “distinguishedName”

An array of the base DNs to search through for groups. Typically uses ou=groups

group_search_base_dns = [“ou=groups,dc=grafana,dc=org”]

Specify names of the ldap attributes your ldap uses

name = "givenName"
surname = "sn"
username = "sAMAccountName"
member_of = "memberOf"
email = “email”

Map ldap groups to grafana org roles

group_dn = "CN=GrafanaAdmins,OU=Groups,OU=Internal,DC=something,DC=contoso,DC=net"
org_role = “Admin”

The Grafana organization database id, optional, if left out the default org (id 1) will be used

org_id = 1

group_dn = "CN=GrafanaEditors,OU=Groups,OU=Internal,DC=something,DC=contoso,DC=net"
org_role = “Editor”


If you want to match all (or no ldap groups) then you can use wildcard

group_dn = "*"
org_role = “Viewer”

LDAP auth is enabled in my grafana.ini.

#################################### Auth LDAP ##########################
;enabled = true
;config_file = /etc/grafana/ldap.toml

I finally got it working after enabling ldap in /usr/share/grafana/conf/defaults.ini