topic User unable to access splunk using LDAP authentication in Security

User unable to access splunk using LDAP authentication

remy06 — Thu, 09 Dec 2010 18:29:03 GMT

Hi,

I've configured splunk for LDAP authentication but have been having issue with a user.

This user(A) exists under the LDAP network group with several other members.I've given the "user" role to this network group and initialy they can all be seen under Manager>access control>Users list.

Recently user(A) complains that he is unable to log in with his AD credentials.When I checked I discovered user(A) is not listed under the Users list anymore but the other members of the LDAP network group remains.

I performed the same step to add "user" role to the network group again and user (A) reappears under the list.

However user(A) is still unable to login with his AD credentials and after the failed login,user(A) is removed from the Users list....

Any idea?

Re: User unable to access splunk using LDAP authentication

remy06 — Fri, 10 Dec 2010 15:00:43 GMT

When this user is in the list,its "default inherited app from" is blank.Theres no error in splunkd for this user as well.

Re: User unable to access splunk using LDAP authentication

remy06 — Mon, 13 Dec 2010 10:32:09 GMT

This is the error in splunkd:

eg.
12-13-2010 09:48:38.538 ERROR AuthenticationManagerLDAP - Could not find user: user(A)

Could it be the user base filtering issue?

Re: User unable to access splunk using LDAP authentication

remy06 — Tue, 14 Dec 2010 09:34:45 GMT

I've checked the AD for the user and found that the user is not in the User Base DN that I've specified already.Have added back the user...