All Apps and Add-ons

LDAP authentication stopped working

neiljpeterson
Communicator

LDAP authentication was working great (connected to active directory)
I installed the Splunk Windows App, triggered the restart, 10 minutes later Splunk was still down.

Went to /Splunk/bin splunk start, said it needed to upgrade, y, upgrade complete and now Active Directory authentication will not work. The settings are all confirmed and the groups visible and mapped correctly in Splunk but no results.

0 Karma
1 Solution

neiljpeterson
Communicator

Yes, the search filter, ie User base DN was wrong. The users were not in that subtree. I changed it to the entire domain (which is not very big)

By Sync I mean Spunk had not yet applied the configuration change I made, this is why AD auth continued to work, until after I performed the restart and upgrade, at which time AD authentication stopped working until I corrected the configuration. It works now that it can find the users.

This is the functionality I am referring to as "syncing" http://i.imgur.com/FFrb6QY.png I am assuming this happens when Splunk starts each time.

View solution in original post

0 Karma

neiljpeterson
Communicator

Yes, the search filter, ie User base DN was wrong. The users were not in that subtree. I changed it to the entire domain (which is not very big)

By Sync I mean Spunk had not yet applied the configuration change I made, this is why AD auth continued to work, until after I performed the restart and upgrade, at which time AD authentication stopped working until I corrected the configuration. It works now that it can find the users.

This is the functionality I am referring to as "syncing" http://i.imgur.com/FFrb6QY.png I am assuming this happens when Splunk starts each time.

0 Karma

ithangasamy_spl
Splunk Employee
Splunk Employee

Are you able to find this user through the ldapsearch filter that you are using in your strategy? Upgrade should not affect your authentication.conf. Not sure what you mean by a sync with AD broke, It appears either your user filter incorrect or the naming attribute is wrong in the strategy config

0 Karma

neiljpeterson
Communicator

So I had changed the User base DN. I assume that the upgrade triggered a sync with AD, which broke the authentication for the users.

0 Karma

neiljpeterson
Communicator

12-04-2013 12:41:05.181 -0600 ERROR AuthenticationManagerLDAP - Could not find user="neil.peterson" with strategy="Admin"
12-04-2013 12:41:05.181 -0600 ERROR UserManagerPro - LDAP Login failed, could not find a valid user="neil.peterson" on any configured servers

0 Karma

ithangasamy_spl
Splunk Employee
Splunk Employee

What is your splunkd.log say? Authentication failed or no matching groups found? or something else?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...