Security

LDAP Search don't work

ifarre
New Member

Hi,

Recently I configured splunk authentication and I mapped groups of our LDAP to use SPLUNK, but i tried to log-in through one LDAP user unsuccesfully.

This is the message that I can view in S.o.S for splunk when i attemp to log-in:

ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="xxxx". Search filter="(memberuid=uid=xxxx,ou=xxxx,dc=xxxx,dc=local)" strategy="FOO"

It seems that includes memberuid without sense for me. How could I configure correctly my ldap auth to achieve some ldap search similar to this one?

uid=xxxx,ou=xxxx,dc=xxxx,dc=local

Tags (1)
0 Karma

Voltaire
Communicator

Not sure how your AD is defined, however here is an example with a virtual AD for testing
Here is a sample LDAP search query

ldapsearch -h "YOURHOSTNAME" or "Ipaddress" -p "your LDAP port" -b "CN=Splunk Users,OU=Security Groups - SPLUNK,DC=YOURS,DC=IT,DC=Splunk,DC=edu" -x -D "Splunk service account" -W "groupNameAttribute"

My AD has a "OU" or group called "Security Groups-Splunk" Under that Group,
I created a "CN" or group called Splunk Users, you can place your potential users in that group.
The display or real user name is "Splunk Service account" -You will need to specify credentials when you test with LDAP search. So ensure you have the correct password. Otherwise your account maybe locked out based upon your inherent Security Group policies.
You can also substitute "realNameAttribute" "displayname" "member" "userNameAttribute"" after -W for further testing

Sample (Domain Component) or your Domain name = yours.IT.Splunk.edu

You can verify your ad configuration using another LDAP Windows GUI browser. I used Active Directory Explorer
Once it works go to Map groups to verify users from Splunk web interface

"http://YourSplunkServer.yours.IT.Splunk.edu8000/en-US/manager/yours/authentication/providers/LDAP"

HTHs

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...