Getting Data In

Error when configuring LDAP authentication over SSL to Windows 2012R2 Active Directory

daniel_splunk
Splunk Employee
Splunk Employee

I tried to enable LDAP over SSL to Windows 2012R2 Active Directory via port 636, got the following error message.

01-11-2018 15:44:18.528 +0800 DEBUG ScopedLDAPConnection - strategy="LDAP Lab" Initializing with LDAPURL="ldaps://10.10.10.30:636"
01-11-2018 15:44:18.528 +0800 DEBUG ScopedLDAPConnection - strategy="LDAP Lab" Attempting bind as DN="cn=svc_splunk_to_ad,ou=my_company,ou=users,ou=systems,dc=com"
01-11-2018 15:44:18.528 +0800 ERROR ScopedLDAPConnection - strategy="LDAP Lab" Error binding to LDAP. reason="Can't contact LDAP server"
01-11-2018 15:44:18.528 +0800 DEBUG ScopedLDAPConnection - strategy="LDAP Lab" Successfully performed unbind

Run the following command and confirmed that LDAP are able to connect using TLS1.1 and TLS1.2

splunk cmd openssl s_client -tls1_1 -connect 10.10.10.30:636
splunk cmd openssl s_client -tls1_2 -connect 10.10.10.30:636

Below is the $SPLUNK_HOME/etc/openldap/ldap.conf

TLS_PROTOCOL_MIN 3.3
TLS_CIPHER_SUITE ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-
AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256

TLS_CACERT /opt/splunk/etc/openldap/certs/certnew.cer
TLS_CACERTDIR /opt/splunk/etc/openldap/certs

Any idea about this?

Tags (1)
0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

Can you try to concat the cert into a single pem file, and then add the following.

TLS_REQCERT never
TLS_CACERT /opt/splunk/etc/openldap/certs/Your_Concat_Cert.pem
#TLS_CACERTDIR /opt/splunk/etc/openldap/certs
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...