ldap queries authentication errors

clymbouris — Wed, 04 Jul 2012 10:48:51 GMT

My setup: splunk 4.3.3, forwarder 4.3.3, ubuntu server 12.04

I can't figure out how to make the ldapqueries work. I get an error with comment: AcceptSecurityContext error, data 52e, v1db1 which leads to a failed password.

my activedirectory.conf is structured like this:

[server]
ldapurl=10.11.12.13 (<< My active directory)
basedn=DC=COMPANY,DC=LOCAL
bindas=CN=ldapquery,CN=Services,DC=COMPANY,DC=LOCAL
password=Password

I checked all my settings and I reset the password but still get the same error. In ldap url I tried everything.. ip, ip:389, ldap://ip, ldap://ip:389

Many thanks

Re: ldap queries authentication errors

ahall_splunk — Wed, 04 Jul 2012 15:35:09 GMT

Unfortunately, the password error is exactly that. When ldapsearch process on the search head connects to the listed server (ldap://ip:389 is the right form), and submits the bindas and password as credentials, it's getting rejected by the Active Directory server.

Some things you can do:

1) Turn on DEBUG (you will need to edit the ldapsearch command for this - just change $INFO to $DEBUG) and check the perl.log file to see if there is anything obvious
2) Use the OpenLDAP command "ldapsearch" with the provided credentials and see if they work.

We will be bringing out an updated ldapsearch command (based on Java that works cross-platform) that provides more functionality (including the ability to turn on debug in the search box) soon. You may want to wait for that release.

topic ldap queries authentication errors in All Apps and Add-ons

ldap queries authentication errors

Re: ldap queries authentication errors