Idapsearch - How to resolve Invalid Credentials error?

[POR160893]

Hey all, 

When I use Idapsearch, I am receiving the following error?

External search command 'ldapsearch' returned error code 1. Script output = "error_message=Invalid credentials for the user with binddn="americas\servicesiem". Please correct and test your SA-ldapsearch credentials in the context of domain="default"

for below query:

| ldapsearch domain=default search="(employeeID=1344541)"  | eval ExchangeServer= "On-Premise Exchange - "+replace(replace(homeMDB, ",.+", ""),"CN=","")  | eval Location= l+" "+st  | eval MailboxLocation=if(isnull(ExchangeServer),"O365 Online", ExchangeServer)  | table employeeID, dellEmployeeStatus, accountExpires, givenName, sn, displayName, mail, extensionAttribute14, smtporsip, department, title,Location, employeeType, sAMAccountName, MailboxLocation | rename dellEmployeeStatus AS Status, accountExpires AS "Account Expires" , employeeID AS "Badge ID", sn AS LastName, givenName AS FirstName, displayName AS "Display Name", department AS Department, title AS "Job Title", sAMAccountName AS NTID, mail AS "Primary Email", extensionAttribute14 AS "Secondary Email", MailboxLocation AS "Mailbox Location" employeeType AS Company sAMAccountName AS NTID | transpose | rename column as "User Info", "row 1" as "Value" | appendpipe [stats count | table Remark]

Can you please help?


Many thanks!

[isoutamo · Accepted solution]

Hi

this means that user which you are using for binding ldapsearch to your AD/LDAP directory has invalid credentials. Maybe the user has expired or someone has change it's password or that has changed on your splunk configuration?

r. Ismo