Security

LDAP authentication not working on Splunk version 6.3.1

guimilare
Communicator

Hello Splunkers,

I have a Splunk environment runnning on cluster.
My indexers (7 peers) were at version 6.1.3 and my search heads (6 SHs) at version 6.2.3.
The autenthication is done by LDAP.

We updated all servers to Splunk version 6.3.1 .
But now I'm not able to connect to LDAP.

The error message is:

An error occurred completing this request: In handler 'LDAP-groups : strategy="Server"' Error binding to LDAP. reason="Can't connect to LDAP server".

Have anyone experienced this issue?
I think this may be a bug.

Thanks in advance.
Best regards

1 Solution

guimilare
Communicator

Problem solved.

The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Regards,
guimilare

View solution in original post

guimilare
Communicator

Problem solved.

The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Regards,
guimilare

View solution in original post

timhope
New Member

Hey, any resolution? I'm now getting the same issue going from 6.1 > 6.3
I tried the same config on 6.2 which worked fine
I have another config for another LDAP server which works, so I think it's a combination of 6.3 + something about this specific AD server

0 Karma

guimilare
Communicator

Hi timhope,

Yes, we found the problem.
The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Hope this helps you.
Regards,

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

This message is indicative of being unable to connect to the ldap server / port specified in your configuration. I'd confirm you can connect to the LDAP server from the OS level. You can ping the server or telnet to 389 / 636 of the ldap server to validate this.

guimilare
Communicator

Hi esix,

Yeah, we can ping the LDAP server and telnet both 389 / 636...

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

If you can connect, make sure you config file specifies the correct host / ip address. Also, test with a known working good user account.

0 Karma

burwell
SplunkTrust
SplunkTrust

We use LDAP in Splunk 6.3.1 on our Search Heads in a Search Head Cluster and LDAP does work for us.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!