All Apps and Add-ons

Why did SA-ldapsearch stop working after upgrade to Splunk 9?

gazoscreek
Explorer

We recently upgraded to Splunk 9.0.0 on our platform and the Splunk Add-On for Active Directory stopped working. We connect to our Active Directory instance using SSL ... and we're getting errors like this one now

2022-10-20 08:05:03,580, Level=ERROR, Pid=5668, File=search_command.py, Line=390, Abnormal exit: (LDAPSocketOpenError('socket ssl wrapping error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1106)'),)
 
What needs to be changed in order to make this work with Splunk 9?

... (We still have an instance running 8.2.6 and the AddOn still works perfectly fine there with the exact same configuration)
 
( we're using the most recent version {3.0.5} of SA-ldapsearch )
 
Thank you
Labels (1)
Tags (1)
0 Karma
1 Solution

gazoscreek
Explorer

We were able to resolve this by deploying an ssl.conf in the app with the following flag disabled:

sslVerifyServerCert = false

 

View solution in original post

0 Karma

dimasfs
Explorer

My workaround was to specify (also on ssl.conf) the

[sslConfig]
caCertFile = <my_ca_file_relative_to_sslRootCAPath>

BUT, as we can read at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf

caCertFile = <filename>
* DEPRECATED. Use the 'sslRootCAPath' setting instead.
* Used only if 'sslRootCAPath' is not set.
* File name (relative to 'caPath') of the CA (Certificate Authority)
  certificate PEM format file containing one or more certificates
  concatenated together.
* Default: cacert.pem

So I guess this is a matter of upgrading the app. I will file a case on it. The app was supposed to work without this deprecated setting.

0 Karma

gazoscreek
Explorer

We were able to resolve this by deploying an ssl.conf in the app with the following flag disabled:

sslVerifyServerCert = false

 

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...