# AD Error fetching roles and users. AD/Hybrid does it just fine **URL:** \ **Category:** Ignition\ **Created:** [April 26, 2022, 7:51pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894 "2022-04-26T19:51:30Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![stuart.williams](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/stuart.williams/32/42310_2.png) [@stuart.williams](https://forum.inductiveautomation.com/u/stuart.williams)\ **Post date:** [April 26, 2022, 7:51pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/1 "2022-04-26T19:51:30Z")
Hi everyone, I have an AD and an AD/Hybrid user source set up. I am able to verify both user sources, and when verifying the AD one I get my account’s role information returned. When I click “manage users” on the hybrid source, I get all the users after a few seconds. However, whenever I click “manage users” on the AD source, no users or roles are returned. In the logs, I repeatedly get an error fetching the roles and users for the AD profile. The account used for LDAP gateway authentication’s username is “Srvc\_IgnitionHUN”. According to [this thread](https://forum.inductiveautomation.com/t/active-directory-security-listing-users-and-roles/10751), a period in the username was affecting the login. Could the underscore be causing the issue? Below is the error from the logs: ```auto javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563] at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.connect(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxFromUrl(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source) at java.naming/javax.naming.spi.NamingManager.getInitialContext(Unknown Source) at java.naming/javax.naming.InitialContext.getDefaultInitCtx(Unknown Source) at java.naming/javax.naming.InitialContext.init(Unknown Source) at java.naming/javax.naming.ldap.InitialLdapContext.(Unknown Source) at com.inductiveautomation.ignition.gateway.authentication.impl.LDAPHelper.openContext(LDAPHelper.java:276) at com.inductiveautomation.ignition.gateway.authentication.impl.LDAPHelper.search(LDAPHelper.java:339) at com.inductiveautomation.ignition.gateway.authentication.impl.ActiveDirectoryUserSource.getRoles(ActiveDirectoryUserSource.java:276) at com.inductiveautomation.ignition.gateway.authentication.UserSourceWrapper.doGetRoles(UserSourceWrapper.java:424) at com.inductiveautomation.ignition.gateway.authentication.UserSourceWrapper$RoleCacheImpl.doUpdate(UserSourceWrapper.java:305) at com.inductiveautomation.ignition.gateway.authentication.UserSourceWrapper$RoleCacheImpl.doUpdate(UserSourceWrapper.java:300) at com.inductiveautomation.ignition.gateway.authentication.AbstractCache$UpdateTask.run(AbstractCache.java:118) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.base/java.util.concurrent.FutureTask.run(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) ``` Any help would be appreciated. Thanks. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 26, 2022, 7:55pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/2 "2022-04-26T19:55:14Z")
> [@stuart.williams](#): > > `LDAP: error code 49 - 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e,` When I look up this error code (49 / 52e) the information I find is: > Returns when [username](https://ldapwiki.com/wiki/Username) is valid but [password](https://ldapwiki.com/wiki/Password)/[credential](https://ldapwiki.com/wiki/Credential) is invalid. source: [https://ldapwiki.com/wiki/Common%20Active%20Directory%20Bind%20Errors](https://ldapwiki.com/wiki/Common%20Active%20Directory%20Bind%20Errors) ---
**Author:** ![stuart.williams](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/stuart.williams/32/42310_2.png) [@stuart.williams](https://forum.inductiveautomation.com/u/stuart.williams)\ **Post date:** [April 26, 2022, 7:59pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/3 "2022-04-26T19:59:33Z")
Thanks for the source. I was not given the password, so I will reach out to the customer to have them verify. If the password is incorrect, shouldn’t I not be able to verify the user source? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 26, 2022, 8:07pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/4 "2022-04-26T20:07:43Z")
When you verify a user on a user source you’re using the username/password you type into the verification page. The action you’re seeing fail is using the credentials configured on the profile as “Gateway Username” and “Password”. ---
**Author:** ![stuart.williams](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/stuart.williams/32/42310_2.png) [@stuart.williams](https://forum.inductiveautomation.com/u/stuart.williams)\ **Post date:** [April 26, 2022, 8:09pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/5 "2022-04-26T20:09:23Z")
Got it. Thanks for the explanation. ---
**Author:** ![Ronne\_Abat](https://avatars.discourse-cdn.com/v4/letter/r/71c47a/32.png) [@Ronne\_Abat](https://forum.inductiveautomation.com/u/Ronne_Abat)\ **Post date:** [March 1, 2023, 6:22pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/6 "2023-03-01T18:22:34Z")
I'm getting the same error code (49). The link from the AD and Ignition was lost because the user passwords were reset. This has happened twice. When I reset the passwords all my users come back. The user does not know how to do this. I'm not resetting the AD user passwords. I confirmed with IT that it's not them. So what can be possibly doing this? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 1, 2023, 6:25pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/7 "2023-03-01T18:25:25Z")
What's the subcode / full error? ---
**Author:** ![Ronne\_Abat](https://avatars.discourse-cdn.com/v4/letter/r/71c47a/32.png) [@Ronne\_Abat](https://forum.inductiveautomation.com/u/Ronne_Abat)\ **Post date:** [March 1, 2023, 6:46pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/8 "2023-03-01T18:46:42Z")
See picture attached. ![Test](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/5/3568c08e09425c41f6c9cfcc69795dc1705869a5.jpeg) UPDATE I reset the AD Password and all accounts came back. Also all accounts password were reset as well. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 1, 2023, 6:48pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/9 "2023-03-01T18:48:00Z")
Sorry, gonna need you to actually copy and paste the whole thing. ---
**Author:** ![Ronne\_Abat](https://avatars.discourse-cdn.com/v4/letter/r/71c47a/32.png) [@Ronne\_Abat](https://forum.inductiveautomation.com/u/Ronne_Abat)\ **Post date:** [March 1, 2023, 7:04pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/10 "2023-03-01T19:04:09Z")
Here you go. ```auto javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 532, v3839] at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source) at com.sun.jndi.ldap.LdapCtx.(Unknown Source) at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source) at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source) at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source) at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source) at javax.naming.spi.NamingManager.getInitialContext(Unknown Source) at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source) at javax.naming.InitialContext.init(Unknown Source) at javax.naming.ldap.InitialLdapContext.(Unknown Source) **at com.inductiveautomation.ignition.gateway.authentication.impl.LDAPHelper.openContext(LDAPHelper.java:207)** at com.inductiveautomation.ignition.gateway.authentication.impl.LDAPHelper.search(LDAPHelper.java:270) at com.inductiveautomation.ignition.gateway.authentication.impl.ADInternalHybridUserSource.getUsers(ADInternalHybridUserSource.java:166) at com.inductiveautomation.ignition.gateway.authentication.UserSourceWrapper.updateCache(UserSourceWrapper.java:120) at com.inductiveautomation.ignition.gateway.authentication.UserSourceWrapper.getUsers(UserSourceWrapper.java:95) ... snipped by moderator ... ``` ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 1, 2023, 7:05pm UTC](https://forum.inductiveautomation.com/t/ad-error-fetching-roles-and-users-ad-hybrid-does-it-just-fine/58894/11 "2023-03-01T19:05:40Z")
49 / 532 means the passwords are expiring. Talk to whoever manages your AD instance.