ldap queries authentication errors

[clymbouris]

My setup: splunk 4.3.3, forwarder 4.3.3, ubuntu server 12.04

I can't figure out how to make the ldapqueries work. I get an error with comment: AcceptSecurityContext error, data 52e, v1db1 which leads to a failed password.

my activedirectory.conf is structured like this:

[server]
ldapurl=10.11.12.13 (<< My active directory)
basedn=DC=COMPANY,DC=LOCAL
bindas=CN=ldapquery,CN=Services,DC=COMPANY,DC=LOCAL
password=Password

I checked all my settings and I reset the password but still get the same error. In ldap url I tried everything.. ip, ip:389, ldap://ip, ldap://ip:389

Many thanks

[ahall_splunk · Accepted solution]

Unfortunately, the password error is exactly that. When ldapsearch process on the search head connects to the listed server (ldap://ip:389 is the right form), and submits the bindas and password as credentials, it's getting rejected by the Active Directory server.

Some things you can do:

1) Turn on DEBUG (you will need to edit the ldapsearch command for this - just change $INFO to $DEBUG) and check the perl.log file to see if there is anything obvious
2) Use the OpenLDAP command "ldapsearch" with the provided credentials and see if they work.

We will be bringing out an updated ldapsearch command (based on Java that works cross-platform) that provides more functionality (including the ability to turn on debug in the search box) soon. You may want to wait for that release.