Security

LDAP Auth with TLS

stl
New Member

I'm attempting to authenticate users in an OpenLDAP 2.4 directory which requires TLS, and the TLS portion appears to be failing. The LDAP server is using a wildcard certificate of *.wiredrive.com from GoDaddy, on a server with the hostname of la.wiredrive.com. This is being used successfully for PAM based authentication of ssh and auth basic for other services so I do know it does play. Appended is the Splunk logging output for LDAP cranked to the debug level. You can see that the initial anonymous bind works so DNS is functioning, however when it attempts the actual tree search which requires TLS it fails with a 'confidentiality required' error leading me to believe it's not actually utilizing the cert.

08-29-2011 13:56:14.548 -0700 DEBUG ScopedLDAPConnection - Initializing with LDAP URL 'ldap://la.wiredrive.com:389'
08-29-2011 13:56:14.548 -0700 DEBUG ScopedLDAPConnection - Attempting anonymous bind
08-29-2011 13:56:14.550 -0700 DEBUG ScopedLDAPConnection - Bind successful
08-29-2011 13:56:14.550 -0700 DEBUG ScopedLDAPConnection - Attempting to read entry for dn: 'ou=people,dc=la,dc=wiredrive,dc=com'
08-29-2011 13:56:14.550 -0700 DEBUG ScopedLDAPConnection - No constraints, returning empty filter
08-29-2011 13:56:14.551 -0700 ERROR ScopedLDAPConnection - Read for DN 'ou=people,dc=la,dc=wiredrive,dc=com' gave error: Confidentiality required
08-29-2011 13:56:14.551 -0700 DEBUG ScopedLDAPConnection - Attempting to load entries...
08-29-2011 13:56:14.551 -0700 ERROR ScopedLDAPConnection - Could not read invalid entry at DN ou=people,dc=la,dc=wiredrive,dc=com
08-29-2011 13:56:14.559 -0700 DEBUG ScopedLDAPConnection - Successfully performed unbind

The modified ldap.conf file in Splunk's etc/openldap/ directory. I've also attempted to set REQCERT to demand with no luck.

ssl start_tls
TLS_REQCERT never
TLS_CACERT $SPLUNK_HOME/etc/openldap/certs/godaddy.pem
TLS_CACERTDIR $SPLUNK_HOME/etc/openldap/cert

Here is my check of the CA certificate, which as mentioned is the same that I am using successfully for PAM.

# openssl verify godaddy.pem 
godaddy.pem: OK
Tags (3)
0 Karma

schplunk_meiste
Engager

Has anybody figured this out. The official documentation I've read doesn't seem to address cases where TLS 1.2 is the only option for a splunk LDAP client to communicate with an openldap server.

0 Karma

mpavlas
Explorer
0 Karma

anark
New Member

Did you find a way to do this? I am also trying to connect to an ldap server using start tls and have not had any luck yet

0 Karma

phatfingers
Explorer

I notice on the first line of your log, it's connecting to "ldap://la.wiredrive.com:389".

  • Using "ldap" and not "ldaps"
  • Using "389" and not "636"

Work through the steps under "Set up LDAP via Splunk Web" on this page:
Setup User Authentication with LDAP

It addresses those specific problems.

0 Karma

stl
New Member

The LDAP server is configured to use TLS which runs on the default port of 389, not the SSL port of 636.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...