All Apps and Add-ons

Splunk Support for Active Directory: Why am I constantly getting errors after I hit the "test connection" button?

wardallen
Path Finder

Splunk v 6.1.4
SA-ldapsearch v2.0.0

ldap.conf
[default]
port = 636
server = adhost.mydomain.local
ssl = 1

[mydomain.local]
alternatedomain =
basedn = dc=mydomain,dc=local
binddn = cn=mycredentials,cn=Service Account,cn=Domain Services,dc=mydomain,dc=local

When I hit the 'test connection' button, I get this in SA-ldapsearch.log every time

2014-10-16 20:46:02,628, Level=ERROR, Pid=15390, File=search_command.py, Line=342, Traceback (most recent call last):
File "/opt/splunk/shared/etc/apps/SA-ldapsearch/bin/packages/splunklib/searchcommands/search_command.py", line 316, in process
self.execute(operation, reader, writer)
File "/opt/splunk/shared/etc/apps/SA-ldapsearch/bin/packages/splunklib/searchcommands/generating_command.py", line 79, in _execute
for record in operation():
File "/opt/splunk/shared/etc/apps/SA-ldapsearch/bin/ldapsearch.py", line 87, in generate
password=configuration.credentials.password) as connection:
File "/opt/splunk/shared/etc/apps/SA-ldapsearch/bin/packages/ldap3/core/connection.py", line 264, in __enter
_
self.open()
File "/opt/splunk/shared/etc/apps/SA-ldapsearch/bin/packages/ldap3/strategy/syncWait.py", line 53, in open
self.connection.refresh_dsa_info()
File "/opt/splunk/shared/etc/apps/SA-ldapsearch/bin/packages/ldap3/core/connection.py", line 618, in refresh_dsa_info
self.server.get_info_from_server(self)
File "/opt/splunk/shared/etc/apps/SA-ldapsearch/bin/packages/ldap3/core/server.py", line 273, in get_info_from_server
self.get_schema_info(connection)
File "/opt/splunk/shared/etc/apps/SA-ldapsearch/bin/packages/ldap3/core/server.py", line 229, in _get_schema_info
schema_entry = connection.response[0]['attributes']['subschemaSubentry'][0] if result else None
File "/opt/splunk/shared/etc/apps/SA-ldapsearch/bin/packages/ldap3/utils/caseInsensitiveDictionary.py", line 33, in __getitem
_
return self._store[self._getkey(key)]
KeyError: 'subschemaSubentry'

Where am I going wrong?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, you should upgrade to version 2.0.1 if you're seeing connection errors: https://splunkbase.splunk.com/app/1151/

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...