All Apps and Add-ons

Splunk App for Windows Infrastructure: Why am I getting ldapfilter error "In order to perform this operation, a successful bind must be completed on the connection."?

jacklai8169
Explorer

DEAR ALL:
My splunk version is 6.1.4 bulid 233537
My Splunk App for Windows Infrastructure version is 1.0.4

When I want to create this report "Active Directory -->users-->User report-->Active", it show this error message......
"External search command 'ldapfilter' returned error code 1. Script output = " ERROR "LDAPOperationsErrorResult - 1 - operationsError - None - 000004DC: LdapErr: DSID-0C090724, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v23f0"

How can I fix it !!!!! please help me ,thank you.....

lmyrefelt
Builder
0 Karma

jacklai8169
Explorer

This is ldap operating log....

  File "/opt/sbox/splunk/etc/apps/SA-ldapsearch/bin/packages/splunklib/searchcommands/search_command.py", line 316, in process
    self._execute(operation, reader, writer)
  File "/opt/sbox/splunk/etc/apps/SA-ldapsearch/bin/packages/splunklib/searchcommands/generating_command.py", line 79, in _execute
    for record in operation():
  File "/opt/sbox/splunk/etc/apps/SA-ldapsearch/bin/ldapsearch.py", line 87, in generate
    password=configuration.credentials.password) as connection:
  File "/opt/sbox/splunk/etc/apps/SA-ldapsearch/bin/packages/ldap3/core/connection.py", line 264, in __enter__
    self.open()
  File "/opt/sbox/splunk/etc/apps/SA-ldapsearch/bin/packages/ldap3/strategy/syncWait.py", line 51, in open
    BaseStrategy.open(self, reset_usage)
  File "/opt/sbox/splunk/etc/apps/SA-ldapsearch/bin/packages/ldap3/strategy/baseStrategy.py", line 90, in open
    self._open_socket(self.connection.server.ssl)
  File "/opt/sbox/splunk/etc/apps/SA-ldapsearch/bin/packages/ldap3/strategy/baseStrategy.py", line 130, in _open_socket
    raise communication_exception_factory(LDAPSocketOpenError, exc)(self.connection.last_error)
LDAPSocketOpenError: socket creation error: [Errno -2] Name or service not known
0 Karma

MuS
SplunkTrust
SplunkTrust

The last error message is pretty clear, python is not able to connect to the server name in your config. check for typos and if you can reach this server

0 Karma

jacklai8169
Explorer

Finally ...........I re-install old version ldap app to solve this problem!!

0 Karma

jacklai8169
Explorer

Now.......the error log show "External search command 'ldapsearch' returned error code 1. Script output = " ERROR "LDAPSocketOpenError at ""/opt/sbox/splunk/etc/apps/SA-ldapsearch/bin/packages/ldap3/strategy/baseStrategy.py"", line 130 : socket creation error: [Errno -2] Name or service not known"

Can someone help me to solve this question~~~~

0 Karma

jacklai8169
Explorer

SORRY........I think I need to config some setting ,but I do not know which file should I config.....can you teach me which file need to config

0 Karma

lmyrefelt
Builder

$SPLUNK_INSTALL/etc/apps/SA-ldapsearch/local/ldap.conf

Check here: (even if it is not the latest, it is the same settings)
http://docs.splunk.com/Documentation/ActiveDirectory/1.2.2/DeployAD/ConfiguretheSA-ldapsearchsupport...

0 Karma

felipetesta
Path Finder

Note: I am familiar with LDAP and AD/LDAP, not with the App in question.

Have you provided "ldapfilter" a valid login and password to access AD? Note that you probably need to provide the full DN of the user, as seen via LDAP. Test the LDAP BIND via an "ldapsearch" (on Linux), like:
ldapsearch -xh your.ad.host.example.com -p tcp.port.of.AD-LDAP.example.com -D "DN of the user best with double quotes" -W -b

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...