LDAP authentication was working great (connected to active directory)
I installed the Splunk Windows App, triggered the restart, 10 minutes later Splunk was still down.
Went to /Splunk/bin splunk start, said it needed to upgrade, y, upgrade complete and now Active Directory authentication will not work. The settings are all confirmed and the groups visible and mapped correctly in Splunk but no results.
12-04-2013 12:41:05.181 -0600 ERROR AuthenticationManagerLDAP - Could not find user="neil.peterson" with strategy="Admin"
12-04-2013 12:41:05.181 -0600 ERROR UserManagerPro - LDAP Login failed, could not find a valid user="neil.peterson" on any configured servers
So I had changed the User base DN. I assume that the upgrade triggered a sync with AD, which broke the authentication for the users.
Are you able to find this user through the ldapsearch filter that you are using in your strategy? Upgrade should not affect your authentication.conf. Not sure what you mean by a sync with AD broke, It appears either your user filter incorrect or the naming attribute is wrong in the strategy config
Yes, the search filter, ie User base DN was wrong. The users were not in that subtree. I changed it to the entire domain (which is not very big)
By Sync I mean Spunk had not yet applied the configuration change I made, this is why AD auth continued to work, until after I performed the restart and upgrade, at which time AD authentication stopped working until I corrected the configuration. It works now that it can find the users.
This is the functionality I am referring to as "syncing" http://i.imgur.com/FFrb6QY.png I am assuming this happens when Splunk starts each time.