topic Re: Error while integrating Splunk with LDAP in Splunk Enterprise

Error while integrating Splunk with LDAP

franciscof — Thu, 11 Feb 2021 15:10:51 GMT

Hi guys, I´ve been trying to integrate Splunk with LDAP but I´m encountering this error:

What could this be?

Thanks in advance

Re: Error while integrating Splunk with LDAP

scelikok — Thu, 11 Feb 2021 16:58:40 GMT

Hi @franciscof,

You may need to uncheck if "Enable referrals with anonymous bind only" in Advanced settings;

Re: Error while integrating Splunk with LDAP

franciscof — Thu, 11 Feb 2021 18:53:11 GMT

That solved the error, but even though the configuration is OK, Splunk is not authenticating through LDAP. I can only access Splunk through my local user. What could this be?

Re: Error while integrating Splunk with LDAP

scelikok — Thu, 11 Feb 2021 18:57:07 GMT

Did you map groups to roles? Required LDAP groups should be mapped to a Splunk Role.

You can find documentation below;

https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/MapLDAPgroupstoSplunkroles

Re: Error while integrating Splunk with LDAP

franciscof — Fri, 12 Feb 2021 12:51:20 GMT

Yes I did. My local user is the same as my LDAP user, could that be causing trouble? However, there are other users that have different local and LDAP users and they also cannot log in.

Re: Error while integrating Splunk with LDAP

scelikok — Fri, 12 Feb 2021 14:05:15 GMT

Hi @franciscof,

Yes, Splunk first check if local users matches. You can check the usernames/groups that comes from LDAP authentication on Setting | Users page. You will see all users with mapped roles and "Authentication System"

You may need to check the setting on "User name attribute" inside LDAP Strategy. It is usually "samaccountname".