# AD Internal Hybrid LDAP Error 49 **URL:** \ **Category:** Ignition Early Access\ **Created:** [March 11, 2019, 10:23pm UTC](https://forum.inductiveautomation.com/t/ad-internal-hybrid-ldap-error-49/23231 "2019-03-11T22:23:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![roger\_larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/roger_larson/32/8574_2.png) [@roger\_larson](https://forum.inductiveautomation.com/u/roger_larson)\ **Post date:** [March 11, 2019, 10:23pm UTC](https://forum.inductiveautomation.com/t/ad-internal-hybrid-ldap-error-49/23231/1 "2019-03-11T22:23:31Z")
Hi everyone, I’m running into an issue in Ignition 8 with AD authentication, where the users list is not appearing. However, I’ve been told this _does_ work in Ignition 7.9 with the same configuration. LDAP error code 49 seems to refer to a logon failure even with correct credentials. Is there a way to figure out what is causing this, or is it probably purely an AD issue? Error trace here: ```auto javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903D3, comment: AcceptSecurityContext error, data 52e, v3839] at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.connect(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source) at java.naming/javax.naming.spi.NamingManager.getInitialContext(Unknown Source) at java.naming/javax.naming.InitialContext.getDefaultInitCtx(Unknown Source) at java.naming/javax.naming.InitialContext.init(Unknown Source) at java.naming/javax.naming.ldap.InitialLdapContext.(Unknown Source) at com.inductiveautomation.ignition.gateway.authentication.impl.LDAPHelper.openContext(LDAPHelper.java:207) at com.inductiveautomation.ignition.gateway.authentication.impl.LDAPHelper.search(LDAPHelper.java:270) at com.inductiveautomation.ignition.gateway.authentication.impl.ADInternalHybridUserSource.getUsers(ADInternalHybridUserSource.java:166) at com.inductiveautomation.ignition.gateway.authentication.UserSourceWrapper.updateCache(UserSourceWrapper.java:120) at com.inductiveautomation.ignition.gateway.authentication.UserSourceManagerImpl$UpdateCacheTask.run(UserSourceManagerImpl.java:393) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.base/java.util.concurrent.FutureTask.run(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) ``` ---
**Author:** ![code\_skin](https://avatars.discourse-cdn.com/v4/letter/c/43a26b/32.png) [@code\_skin](https://forum.inductiveautomation.com/u/code_skin)\ **Post date:** [March 12, 2019, 5:40pm UTC](https://forum.inductiveautomation.com/t/ad-internal-hybrid-ldap-error-49/23231/2 "2019-03-12T17:40:13Z")
I can confirm AD is working in Ignition 8. We don’t use a hybrid user source though. I quickly configured a _AD/Internal Hybrid_ user source without any issues. I created a test role and assigned it to myself. ---
**Author:** ![roger\_larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/roger_larson/32/8574_2.png) [@roger\_larson](https://forum.inductiveautomation.com/u/roger_larson)\ **Post date:** [March 13, 2019, 3:41pm UTC](https://forum.inductiveautomation.com/t/ad-internal-hybrid-ldap-error-49/23231/3 "2019-03-13T15:41:28Z")
While i’m convinced it will work, for some reason this particular AD connection still does not work, even though the same configuration worked in 7.9.10. Still no way to authenticate it. I’m not sure if the name is disliked or what. ---
**Author:** ![code\_skin](https://avatars.discourse-cdn.com/v4/letter/c/43a26b/32.png) [@code\_skin](https://forum.inductiveautomation.com/u/code_skin)\ **Post date:** [March 13, 2019, 3:52pm UTC](https://forum.inductiveautomation.com/t/ad-internal-hybrid-ldap-error-49/23231/4 "2019-03-13T15:52:54Z")
Check/compare your advanced settings (under **show advanced properties** ) against the 7.9 gateway. Looks like hex code 52e _Returns when username is valid but password/credential is invalid. Will prevent most other errors from being displayed as noted._ ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [March 26, 2019, 6:52pm UTC](https://forum.inductiveautomation.com/t/ad-internal-hybrid-ldap-error-49/23231/5 "2019-03-26T18:52:51Z")
Hi @roger_larson - Did you ever get this resolved? I recently ran into a similar issue. I noticed that in the advanced properties (shown by toggling the show advanced properties checkbox at the bottom of the configuration), `Automatic Suffix` was checked which means that any username I use to login will always automatically be appended with the domain in the configuration. I was trying to login with the full email such as `foo@example.com` but the system was appending the domain after that (`foo@example.com@example.com`) which failed of course. So I tried logging in with just the name portion of the email `foo` and it worked. Still doesn’t explain the difference between 7.9 and 8.0 though. I’m not what is causing the difference in behavior there from the information provided… ---
**Author:** ![roger\_larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/roger_larson/32/8574_2.png) [@roger\_larson](https://forum.inductiveautomation.com/u/roger_larson)\ **Post date:** [March 26, 2019, 8:00pm UTC](https://forum.inductiveautomation.com/t/ad-internal-hybrid-ldap-error-49/23231/6 "2019-03-26T20:00:26Z")
Interesting! As far as I know, our username prefix/suffix is blank and automatic suffix is off. We pretty much can’t even see users. And no, it was never resolved, we sort of gave up on AD for now, at least until it is known why this configuration does not work in Ignition 8. I can’t tell if it is the AD server, some wrong information in the user source config page (I don’t have the information to verify whether it is or is not correct, but it _did_ work at some point), or something really did change from Ignition 7 to 8 that killed our connection. We may wait until tech support for this is available, unless there are a few ideas as to what could cause this. But, for context, this is what we’re currently getting after switching to 8: ```auto javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903D3, comment: AcceptSecurityContext error, data 52e, v3839] at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.connect(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtx.(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source) at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source) at java.naming/javax.naming.spi.NamingManager.getInitialContext(Unknown Source) at java.naming/javax.naming.InitialContext.getDefaultInitCtx(Unknown Source) at java.naming/javax.naming.InitialContext.init(Unknown Source) at java.naming/javax.naming.ldap.InitialLdapContext.(Unknown Source) at com.inductiveautomation.ignition.gateway.authentication.impl.LDAPHelper.openContext(LDAPHelper.java:207) at com.inductiveautomation.ignition.gateway.authentication.impl.LDAPHelper.search(LDAPHelper.java:270) at com.inductiveautomation.ignition.gateway.authentication.impl.ADInternalHybridUserSource.getUsers(ADInternalHybridUserSource.java:166) at com.inductiveautomation.ignition.gateway.authentication.UserSourceWrapper.updateCache(UserSourceWrapper.java:120) at com.inductiveautomation.ignition.gateway.authentication.UserSourceManagerImpl$UpdateCacheTask.run(UserSourceManagerImpl.java:393) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.base/java.util.concurrent.FutureTask.run(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) ``` ---
**Author:** ![melwadeya](https://avatars.discourse-cdn.com/v4/letter/m/ed8c4c/32.png) [@melwadeya](https://forum.inductiveautomation.com/u/melwadeya)\ **Post date:** [February 1, 2021, 7:45pm UTC](https://forum.inductiveautomation.com/t/ad-internal-hybrid-ldap-error-49/23231/7 "2021-02-01T19:45:24Z")
Hello, Did you manage to resolve the issue? I am using Ignition (V8.1.1). I have an AD user source and user verification is successful. However, when I created an Identity provider that utilizes the same AD user source I get the same LDAP error as you (code 49 data 775) any thoughts? Regards, ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [February 4, 2021, 9:30pm UTC](https://forum.inductiveautomation.com/t/ad-internal-hybrid-ldap-error-49/23231/8 "2021-02-04T21:30:00Z")
> [@melwadeya](#): > > code 49 data 775 That code is slightly different than what was mentioned above. According to this: [https://ldapwiki.com/wiki/Common%20Active%20Directory%20Bind%20Errors](https://ldapwiki.com/wiki/Common%20Active%20Directory%20Bind%20Errors) looks like your user is locked out on the AD side. you'll have to wait until the account is unlocked or ask your AD admin to manually unlock the user and try again...