LDAP logins to Kiwi Syslog Server NG fail with “Username and/or password is incorrect or expired” when using Active Directory accounts

LDAP authentication to the Kiwi Syslog Server NG web interface fails for Active Directory (AD) users, even though LDAP is configured and the same AD credentials work for other services. Attempting to sign in to Kiwi with an AD account returns the generic error “Username and/or password is incorrect or expired.”

The LDAP configuration in Kiwi Syslog Server NG was pointing the Groups OU to the wrong location in Active Directory, so the product could not find the security groups mapped in Admin Group Name and User Group Name. As a result, group membership checks failed and valid AD credentials were rejected with the generic “Username and/or password is incorrect or expired” error until the Groups OU was corrected to the OU where the Kiwi groups actually reside, relative to the configured Base DN.

The key change is to make sure the Groups OU in the Kiwi LDAP settings points to the OU where the Kiwi security groups actually live in Active Directory, and then verify group membership and connectivity before testing login again.

1. Review the current LDAP configuration in Kiwi Syslog Server NG

   1. Open the Kiwi Syslog Server NG web interface.
   2. Go to Settings → Authentication → LDAP.
   3. Confirm that Enable LDAP Authentication is turned on.
   4. Verify that the following values are populated as expected for your environment:
      
      • LDAP Server (FQDN or IP of the domain controller)
      • Port (typically 389 for Plain/StartTLS, 636 for LDAPS)
      • Domain and Base DN (root of the directory subtree used for lookups)

2. Correct the Groups OU to point to the actual Kiwi groups location

   1. In Settings → Authentication → LDAP, locate the Groups OU field.
   2. Set Groups OU to the OU path where the Kiwi admin/user security groups are actually stored, relative to the Base DN. For example, if:
      
      • Base DN is DC=example,DC=com, and
      • Your Kiwi groups are under OU=Groups,OU=Monitoring,DC=example,DC=com,
        then set Groups OU to: OU=Groups,OU=Monitoring.
   3. Apply the change and save the LDAP configuration.
   4. Ensure that Admin Group Name and User Group Name match the AD security group names that should have access to Kiwi (for example, Kiwi-Admins and Kiwi-Users).