Security

splunk AD authentication Setup

Newbie
Engager

Trying to Setup Authentication using AD windows 2008, in way that all the users in the domain will login using their domain ID and password.

Splunk version Splunk 4.1.2 build 79191

error : ERROR ScopedLDAPConnection - Search for DN 'cn=users,dc=domain,dc=com' gave error: Operations error ERROR AuthenticationManagerLDAP - Could not find user: splunkuser

I am able to browse AD with Softerra LDAP Browser with Bind id and password,and list all the object.

I have referred to http://splunkninja.com/video/splunk-ninja-basic-training

Any pointers would be appreciated.

thank you Newbie

Tags (1)

weeb
Splunk Employee
Splunk Employee

Example authentication.conf:

[authentication]
authSettings = AD
authType = LDAP

[AD]
SSLEnabled = 1
anonymous_referrals = 0
bindDN = batman
bindDNpassword = $1$oX4lsdfsdf899f0s//==
charset = utf8
groupBaseDN = ou=People,ou=Security,dc=gotham,dc=local
groupBaseFilter = (objectClass=group)
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = batcave01dc02.gotham.city
nestedGroups = 0
network_timeout = 20
port = 636
realNameAttribute = displayname
sizelimit = 1000
timelimit = 15
userBaseDN = OU=People,DC=gotham,DC=local
userBaseFilter = (objectCategory=Person)
userNameAttribute = samaccountname

You might have namespace conflicts between Splunk users and AD users. Unselect "Splunk" as an authentication option to prevent conflicts.

No restart of Splunk is needed. Confirm AD groups are seen under Access controls » Authentication method » LDAP strategies » Map Groups.

To test: 1) map a group to a desired role, then 2) login as a member of the group.

Simeon
Splunk Employee
Splunk Employee

It would appear that the baseDN for your users does not contain the "splunkuser". Supplying your Group and User baseDN settings in addition to the mapped roles would be helpful in solving your problem. I suggest you check the following as well:

1 - Does Splunk successfully bind to AD? If you examine the splunkd.log file, you should see the attempt to bind to the LDAP server.

2 - Can you browse the LDAP groups on the AD server, while logged in to Splunk Web? This will confirm if you have configured the groupbaseDN correctly.

3 - AFTER you mapped an LDAP group to a specific role, are you able to view the users configured?

Newbie
Engager

Thanks Simeon, Issue i had was related to Binding, so it was bound to LDAP. After I fixed BasedDN everything worked 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...