Security

How to replace master node with ldap- reconfig required?

nathanpaul8
New Member

I am trying to move master node to a different node.

  1. Setup a new node.
  2. configured as master node.
  3. Modified server.conf similar to old master node for params except ssh key.
  4. Copied _cluster app from old node to new node.
  5. Restarted new master node

I am ready to point indexers and search nodes to new master node.

Old master is configured for ldap auth. But even after restart the server is not working for ldap auth. Do I need to reconfigure ldap on new master ?. I see authentication.conf in _cluster

Thanks,

NP

0 Karma
1 Solution

p_gurav
Champion

Hi,

You have to do following things:
1. move old authentication.conf and LDAP.conf and openldap certs diretory to new server
2. Just replace the hashed values with the plaintext password and copy that file over. The next time the Splunk instance starts, it will re-hash the password.

View solution in original post

p_gurav
Champion

Hi,

You have to do following things:
1. move old authentication.conf and LDAP.conf and openldap certs diretory to new server
2. Just replace the hashed values with the plaintext password and copy that file over. The next time the Splunk instance starts, it will re-hash the password.

basu42002
Path Finder

I tried the above and I get this error:
An error occurred completing this request: In handler 'LDAP-groups': strategy="###" Error binding to LDAP. reason="Invalid credentials".
While the old master node has the same credentials, the new master displays the above error.

which field contains the hashed values? as I did not replace the values.
Under ldap.conf, both "TLS_CACERT" and "TLS_CACERTDIR" are commented and TLS_REQCERT is set to "never".
Could you please let me know what could be the reason.

0 Karma

basu42002
Path Finder

Got it, the credentials in binddnspassword replaced with plaintext password. Now able to login with Ldap credentials. Thank you p_gurav

0 Karma

p_gurav
Champion

Happy to help!!! Requesting you to accept answer if its helpful.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...