LDAP authentication stopped working

[neiljpeterson]

LDAP authentication was working great (connected to active directory)
I installed the Splunk Windows App, triggered the restart, 10 minutes later Splunk was still down.

Went to /Splunk/bin splunk start, said it needed to upgrade, y, upgrade complete and now Active Directory authentication will not work. The settings are all confirmed and the groups visible and mapped correctly in Splunk but no results.

[neiljpeterson · Accepted solution]

Yes, the search filter, ie User base DN was wrong. The users were not in that subtree. I changed it to the entire domain (which is not very big)

By Sync I mean Spunk had not yet applied the configuration change I made, this is why AD auth continued to work, until after I performed the restart and upgrade, at which time AD authentication stopped working until I corrected the configuration. It works now that it can find the users.

This is the functionality I am referring to as "syncing" http://i.imgur.com/FFrb6QY.png I am assuming this happens when Splunk starts each time.

[ithangasamy_spl]

Are you able to find this user through the ldapsearch filter that you are using in your strategy? Upgrade should not affect your authentication.conf. Not sure what you mean by a sync with AD broke, It appears either your user filter incorrect or the naming attribute is wrong in the strategy config

[neiljpeterson]

So I had changed the User base DN. I assume that the upgrade triggered a sync with AD, which broke the authentication for the users.

[neiljpeterson]

12-04-2013 12:41:05.181 -0600 ERROR AuthenticationManagerLDAP - Could not find user="neil.peterson" with strategy="Admin"
12-04-2013 12:41:05.181 -0600 ERROR UserManagerPro - LDAP Login failed, could not find a valid user="neil.peterson" on any configured servers

[ithangasamy_spl]

What is your splunkd.log say? Authentication failed or no matching groups found? or something else?