topic Unable to authenticate users in active directory in Security

Unable to authenticate users in active directory

jeffwarn — Tue, 15 Mar 2011 04:09:18 GMT

I have splunk configured to authenticate against AD. I have my service account set and the following options configured:

User Base DN: OU=Users,OU=My City,OU=North America,DC=us,DC=mydomain,DC=com

User Name Attribute: samaccountname

Group Mapping: memberof

Group Base DN: OU=Groups,OU=My City,OU=North America,DC=us,DC=mydomain,DC=com

Group Name Attribute: cn

Group Member Attr: member

Once saved, I can get a list of my groups just fine when I click on the "Configure LDAP Role Mapping" link. This is where it gets strange. I have a few users in a group called "Product Ops". In this group, there are about 10 users defined (example):

CN=Some Person,OU=Users,OU=My City,OU=North America,DC=us,DC=mydomain,DC=com

I assign this group "Product Ops" to the user role and click save. No users are able to log in and I find something like this in the logs:

splunkd.log:03-14-2011 16:04:09.722 WARN AuthenticationManagerLDAP - User 'someuser' had 6 values for mapping attribute 'memberof'. Group members should be uniquely defined.

splunkd.log:03-14-2011 16:04:09.724 ERROR AuthenticationManagerLDAP - User 'someuser' has matching LDAP groups, but none are mapped to Splunk roles

Now if I added a new group in my AD called "Splunk Users" and instead of putting the user directly into the group and just move the "Product Ops" into is, the user can log in just fine.

What am I missing here? I'm at the point where I'd much rather just link individual users from AD to splunk roles (can this be done?)

Re: Unable to authenticate users in active directory

gkanapathy — Tue, 15 Mar 2011 06:54:38 GMT

The Group Mapping attribute in AD should be left blank, or set to "distinguishedName" or "dn". This attribute specifies what field within the user record maps to the Group Member Attribute within the group. In AD (and LDAP in general) groups are not stored on the user object, but on the group object. The AD users memberof attribute is a synthetic attribute based on the group member attribute

Re: Unable to authenticate users in active directory

jeffwarn — Tue, 15 Mar 2011 20:22:19 GMT

Thanks that did it. On a side note, that actually broke the way it was working (embedded groups), but I saw that technically isn't supported at the moment.

Re: Unable to authenticate users in active directory

praveenkpatidar — Thu, 23 Jun 2016 02:24:11 GMT

Perfect It works for me after 3 days of headache.
THanks a ton !!!