All Apps and Add-ons

ldap queries authentication errors

clymbouris
Path Finder

My setup: splunk 4.3.3, forwarder 4.3.3, ubuntu server 12.04

I can't figure out how to make the ldapqueries work. I get an error with comment: AcceptSecurityContext error, data 52e, v1db1 which leads to a failed password.

my activedirectory.conf is structured like this:

[server]
ldapurl=10.11.12.13 (<< My active directory)
basedn=DC=COMPANY,DC=LOCAL
bindas=CN=ldapquery,CN=Services,DC=COMPANY,DC=LOCAL
password=Password

I checked all my settings and I reset the password but still get the same error. In ldap url I tried everything.. ip, ip:389, ldap://ip, ldap://ip:389

Many thanks

0 Karma
1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

Unfortunately, the password error is exactly that. When ldapsearch process on the search head connects to the listed server (ldap://ip:389 is the right form), and submits the bindas and password as credentials, it's getting rejected by the Active Directory server.

Some things you can do:

1) Turn on DEBUG (you will need to edit the ldapsearch command for this - just change $INFO to $DEBUG) and check the perl.log file to see if there is anything obvious
2) Use the OpenLDAP command "ldapsearch" with the provided credentials and see if they work.

We will be bringing out an updated ldapsearch command (based on Java that works cross-platform) that provides more functionality (including the ability to turn on debug in the search box) soon. You may want to wait for that release.

View solution in original post

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Unfortunately, the password error is exactly that. When ldapsearch process on the search head connects to the listed server (ldap://ip:389 is the right form), and submits the bindas and password as credentials, it's getting rejected by the Active Directory server.

Some things you can do:

1) Turn on DEBUG (you will need to edit the ldapsearch command for this - just change $INFO to $DEBUG) and check the perl.log file to see if there is anything obvious
2) Use the OpenLDAP command "ldapsearch" with the provided credentials and see if they work.

We will be bringing out an updated ldapsearch command (based on Java that works cross-platform) that provides more functionality (including the ability to turn on debug in the search box) soon. You may want to wait for that release.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...