[Issue] Authentication finally failed for user from "Some IP:Some Number"

[GitUseDeveloper]

opensearch: v2.15.0

OpenSearch side logs at the time the error occurred, the log says the following

Error: Authentication finally failed for "xxxuseryyy" from {instance:some number}.

It's basically tells like the user is not from LDAP, because the user created internally. But it didn't fallback to internal authentication once failed for LDAP auth. Failed only once, unable to reproduce, no network issues at that time. That's my worry. Can anyone help me with this issue

[cwperks]

@GitUseDeveloper Can you please provide more info like the config.yml file with secrets redacted? What are the order: of the LDAP + Internal backend authenticators?

You may also have some luck posting on the opensearch forum: https://forum.opensearch.org/

[GitUseDeveloper]

Hi @cwperks,

The order of LDAP is 2 and internal auth is 4. My concern is the error 'authentication finally failed' occurred only once for the internal user.

But I'm getting the LDAP authentication failure for the user frequently. That's fine because we didn't skip the internal user from LDAP config.