Getting Data In

Is it possible to have multiple hosts for one LDAP Strategy?

fjmelo
Engager

Hi all,

We have Splunk connected to 5 LDAP domains and each one with at least 10 servers. Today Splunk is pointing to the domain name "domain1.com" that has the DNS pointing and rotating to each one of the 10 servers after some time, even if the Active Directory server is out the "domain1.com", it still points to it and times out. When this happens, the connections to Splunk using SSO hang until the AD server is rotated to another server.

We also had this situation on our SAP portal server (That as Splunk seems to be not LDAP aware), but we fixed this using the names of 4 servers separated by commas so the rotation would happen on SAP level and only on those servers. We would like to approach it the same way in Splunk. Is that possible?

Example below:

[domain1]
host = server1.domain1.com,server2.domain1.com,server3.domain1.com,server4.domain1.com
port = 389
SSLEnabled = 0
....

Thanks,

ursfischer
Engager

Hello there,

Is there a solution for this question. We too (like many others i guess) have domains with multiple LDAP servers behind. Either we register per domain several strategies what gives us in the end about 15 strategies an more or we can solve with the DNS record for the Domain (example demo.domain.local). In my opinion Splunk will then connect to one of the multiple Servers behind this DNS record with Round Robin. What are the possibilities and how did you solve this?

With so many strategies we have the problem that with an adjustment to roles with subsequent reload the whole thing with a search head cluster at the end goes very long. Clearly, the strategies here are only one part of many in a reload, and yet this would help us.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

one option is use several strategies which are pointing to different LDAP servers which have identical content. Another option is use LB before LDAPs and use this VIP address as server for strategy. That is probably more easier solution for overall.

r. Ismo

0 Karma

adhoke_splunk
Splunk Employee
Splunk Employee

Ldap strategy can point to only one ldap server. However, you can specify multiple ldap strategies, one for each of your servers. In this case, strategies will be same except for host.
Specify those strategies in authSettings as comma separated values. Splunk will attempt to connect to all strategies.

https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Authenticationconf

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...