Security

LDAP Configuration is asking for attributes 1.1 - failing

cam343
Path Finder

Hello I'm trying to configure Splunk 7.3.0 (657388c7a488) with LDAP authentication but it keeps failing during the setup with the error:

"Encountered the following error while trying to save: Could not find userBaseDN on the LDAP server: ou=Active Staff,ou=People,dc=mydomain,dc=edu"

After lots of debugging the ldap search it uses during the base configuration uses "Attributes 1.1" for LDAP.

ie This search works on our LDAP:

ldapsearch -x -H ldaps://10.231.4.20:636  -D "uid=cam34,ou=Active Staff,ou=People,dc=mydomain,dc=edu" -W -b "ou=Active Staff,ou=People,dc=mydomain,dc=edu" "(objectclass=*)"

How ever the following fails to return results:

ldapsearch -x -H ldaps://10.231.4.20:636  -D "uid=cam34,ou=Active Staff,ou=People,dc=mydomain,dc=edu" -W -b "ou=Active Staff,ou=People,dc=mydomain,dc=edu" "(objectclass=*)" 1.1

This "1.1" type search is what Splunk is trying to use.

How can I change this behaviour in Splunk?

Thanks
Cam

0 Karma
1 Solution

cam343
Path Finder

Solved it myself...
Turns out the problem was with the LDAP Proxy software itself (glauth).
Seems glauth doesnt understand attributes only searches ([github]/glauth/glauth/issues/89)

View solution in original post

0 Karma

cam343
Path Finder

Solved it myself...
Turns out the problem was with the LDAP Proxy software itself (glauth).
Seems glauth doesnt understand attributes only searches ([github]/glauth/glauth/issues/89)

0 Karma

cam343
Path Finder

No sorry - From the debugging I can see the search its failing on.
Definately an issue with attributes 1.1

09:57:43.048353 Search ▶ DEBU 01c Search req to backend: &ldap.SearchRequest{
    BaseDN:       "ou=Active Staff,ou=People,dc=mydomain,dc=edu",
    Scope:        0,
    DerefAliases: 0,
    SizeLimit:    1000,
    TimeLimit:    15,
    TypesOnly:    false,
    Filter:       "(objectclass=*)",
    Attributes:   {"1.1"},
    Controls:     {
    },
}
09:57:43.050451 Search ▶ DEBU 01d Backend Search result: &ldap.SearchResult{
    Entries: {
        &ldap.Entry{
            DN:         "ou=Active Staff,ou=People,dc=mydomain,dc=edu",
            Attributes: nil,
        },
    },
    Referrals: {},
    Controls:  {
    },
}
0 Karma

nareshinsvu
Builder

I recently got similar issues with userBaseDN messages. But my problem was with groupBaseDN

https://answers.splunk.com/answers/758767/ldap-configuration-issue.html

Did you provide groupBaseDN while defining your LDAP strategy?

groupBaseDN - a complete DN (including CN) of your LDAP group

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...