Getting Data In

Splunk Support for Active Directory: How to use GSS-API authentication rather than Simple-Auth

bahndg
Explorer

Splunk Version: 6.6.11
SA-ldapsearch App Version: 2.1.6 Build: 738

Hello,

we have multiply domains in the forest and were able to connect to most domains using LDAP on 636 (TLS) using a Bind in DN-Format.
But with two domains we are not using Simple-Auth via TLS Port 636 but rather GSS-API without TLS on Port 389 (GSS will add an secure layer).

It seems the addon does not support this authentication at all because we always get the error message

"External search command 'ldaptestconnection' returned error code 1. Script output = "error_message= # host: XXXX.DC: Could not access the directory service at ldap://XXXX.DC:389: Invalid credentials for the user with binddn="User@Domain.de". Please correct and test your SA-ldapsearch credentials in the context of domain="XXXX.DC" ""

But the credentials are definately correct and I am able to connect with various tools like LDP.exe or LDAPAdmin with the same settings without any problems.

How to make SA-ldapsearch use GSS-API with Port 389 on a DC using UPN-Username "User@otherdomain.de" with and without SASL ?

0 Karma

mkalyakin
Explorer

Have same problem too.
Have you found any solution or workaround?

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...