All Apps and Add-ons

LDAP authentication stopped working

neiljpeterson
Communicator

LDAP authentication was working great (connected to active directory)
I installed the Splunk Windows App, triggered the restart, 10 minutes later Splunk was still down.

Went to /Splunk/bin splunk start, said it needed to upgrade, y, upgrade complete and now Active Directory authentication will not work. The settings are all confirmed and the groups visible and mapped correctly in Splunk but no results.

0 Karma
1 Solution

neiljpeterson
Communicator

Yes, the search filter, ie User base DN was wrong. The users were not in that subtree. I changed it to the entire domain (which is not very big)

By Sync I mean Spunk had not yet applied the configuration change I made, this is why AD auth continued to work, until after I performed the restart and upgrade, at which time AD authentication stopped working until I corrected the configuration. It works now that it can find the users.

This is the functionality I am referring to as "syncing" http://i.imgur.com/FFrb6QY.png I am assuming this happens when Splunk starts each time.

View solution in original post

0 Karma

neiljpeterson
Communicator

Yes, the search filter, ie User base DN was wrong. The users were not in that subtree. I changed it to the entire domain (which is not very big)

By Sync I mean Spunk had not yet applied the configuration change I made, this is why AD auth continued to work, until after I performed the restart and upgrade, at which time AD authentication stopped working until I corrected the configuration. It works now that it can find the users.

This is the functionality I am referring to as "syncing" http://i.imgur.com/FFrb6QY.png I am assuming this happens when Splunk starts each time.

0 Karma

ithangasamy_spl
Splunk Employee
Splunk Employee

Are you able to find this user through the ldapsearch filter that you are using in your strategy? Upgrade should not affect your authentication.conf. Not sure what you mean by a sync with AD broke, It appears either your user filter incorrect or the naming attribute is wrong in the strategy config

0 Karma

neiljpeterson
Communicator

So I had changed the User base DN. I assume that the upgrade triggered a sync with AD, which broke the authentication for the users.

0 Karma

neiljpeterson
Communicator

12-04-2013 12:41:05.181 -0600 ERROR AuthenticationManagerLDAP - Could not find user="neil.peterson" with strategy="Admin"
12-04-2013 12:41:05.181 -0600 ERROR UserManagerPro - LDAP Login failed, could not find a valid user="neil.peterson" on any configured servers

0 Karma

ithangasamy_spl
Splunk Employee
Splunk Employee

What is your splunkd.log say? Authentication failed or no matching groups found? or something else?

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...