topic Re: LDAP authentication not working on Splunk version 6.3.1 in Security

LDAP authentication not working on Splunk version 6.3.1

guimilare — Sat, 28 Nov 2015 06:38:55 GMT

Hello Splunkers,

I have a Splunk environment runnning on cluster.
My indexers (7 peers) were at version 6.1.3 and my search heads (6 SHs) at version 6.2.3.
The autenthication is done by LDAP.

We updated all servers to Splunk version 6.3.1 .
But now I'm not able to connect to LDAP.

The error message is:

An error occurred completing this request: In handler 'LDAP-groups : strategy="Server"' Error binding to LDAP. reason="Can't connect to LDAP server".

Have anyone experienced this issue?
I think this may be a bug.

Thanks in advance.
Best regards

Re: LDAP authentication not working on Splunk version 6.3.1

burwell — Sat, 28 Nov 2015 06:54:33 GMT

We use LDAP in Splunk 6.3.1 on our Search Heads in a Search Head Cluster and LDAP does work for us.

Re: LDAP authentication not working on Splunk version 6.3.1

esix_splunk — Sat, 28 Nov 2015 13:58:51 GMT

This message is indicative of being unable to connect to the ldap server / port specified in your configuration. I'd confirm you can connect to the LDAP server from the OS level. You can ping the server or telnet to 389 / 636 of the ldap server to validate this.

Re: LDAP authentication not working on Splunk version 6.3.1

guimilare — Mon, 30 Nov 2015 17:35:33 GMT

Hi esix,

Yeah, we can ping the LDAP server and telnet both 389 / 636...

Re: LDAP authentication not working on Splunk version 6.3.1

esix_splunk — Mon, 30 Nov 2015 20:14:54 GMT

If you can connect, make sure you config file specifies the correct host / ip address. Also, test with a known working good user account.

Re: LDAP authentication not working on Splunk version 6.3.1

timhope — Mon, 15 Feb 2016 05:02:51 GMT

Hey, any resolution? I'm now getting the same issue going from 6.1 > 6.3
I tried the same config on 6.2 which worked fine
I have another config for another LDAP server which works, so I think it's a combination of 6.3 + something about this specific AD server

Re: LDAP authentication not working on Splunk version 6.3.1

guimilare — Mon, 15 Feb 2016 12:34:00 GMT

Hi timhope,

Yes, we found the problem.
The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Hope this helps you.
Regards,

Re: LDAP authentication not working on Splunk version 6.3.1

guimilare — Mon, 15 Feb 2016 12:35:54 GMT

Problem solved.

The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Regards,
guimilare