topic Re: splunk AD authentication Setup in Security

splunk AD authentication Setup

Newbie — Tue, 01 Jun 2010 17:50:04 GMT

Trying to Setup Authentication using AD windows 2008, in way that all the users in the domain will login using their domain ID and password.

Splunk version Splunk 4.1.2 build 79191

error : ERROR ScopedLDAPConnection - Search for DN 'cn=users,dc=domain,dc=com' gave error: Operations error ERROR AuthenticationManagerLDAP - Could not find user: splunkuser

I am able to browse AD with Softerra LDAP Browser with Bind id and password,and list all the object.

I have referred to http://splunkninja.com/video/splunk-ninja-basic-training

Any pointers would be appreciated.

thank you Newbie

Re: splunk AD authentication Setup

Simeon — Tue, 01 Jun 2010 22:42:29 GMT

It would appear that the baseDN for your users does not contain the "splunkuser". Supplying your Group and User baseDN settings in addition to the mapped roles would be helpful in solving your problem. I suggest you check the following as well:

1 - Does Splunk successfully bind to AD? If you examine the splunkd.log file, you should see the attempt to bind to the LDAP server.

2 - Can you browse the LDAP groups on the AD server, while logged in to Splunk Web? This will confirm if you have configured the groupbaseDN correctly.

3 - AFTER you mapped an LDAP group to a specific role, are you able to view the users configured?

Re: splunk AD authentication Setup

Newbie — Wed, 02 Jun 2010 18:19:23 GMT

Thanks Simeon, Issue i had was related to Binding, so it was bound to LDAP. After I fixed BasedDN everything worked 🙂

Re: splunk AD authentication Setup

weeb — Wed, 12 Feb 2014 00:37:41 GMT

Example authentication.conf:

[authentication]
authSettings = AD
authType = LDAP

[AD]
SSLEnabled = 1
anonymous_referrals = 0
bindDN = batman
bindDNpassword = $1$oX4lsdfsdf899f0s//==
charset = utf8
groupBaseDN = ou=People,ou=Security,dc=gotham,dc=local
groupBaseFilter = (objectClass=group)
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = batcave01dc02.gotham.city
nestedGroups = 0
network_timeout = 20
port = 636
realNameAttribute = displayname
sizelimit = 1000
timelimit = 15
userBaseDN = OU=People,DC=gotham,DC=local
userBaseFilter = (objectCategory=Person)
userNameAttribute = samaccountname

You might have namespace conflicts between Splunk users and AD users. Unselect "Splunk" as an authentication option to prevent conflicts.

No restart of Splunk is needed. Confirm AD groups are seen under Access controls » Authentication method » LDAP strategies » Map Groups.

To test: 1) map a group to a desired role, then 2) login as a member of the group.