Security

LDAP authentication not working on Splunk version 6.3.1

guimilare
Communicator

Hello Splunkers,

I have a Splunk environment runnning on cluster.
My indexers (7 peers) were at version 6.1.3 and my search heads (6 SHs) at version 6.2.3.
The autenthication is done by LDAP.

We updated all servers to Splunk version 6.3.1 .
But now I'm not able to connect to LDAP.

The error message is:

An error occurred completing this request: In handler 'LDAP-groups : strategy="Server"' Error binding to LDAP. reason="Can't connect to LDAP server".

Have anyone experienced this issue?
I think this may be a bug.

Thanks in advance.
Best regards

1 Solution

guimilare
Communicator

Problem solved.

The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Regards,
guimilare

View solution in original post

guimilare
Communicator

Problem solved.

The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Regards,
guimilare

timhope
New Member

Hey, any resolution? I'm now getting the same issue going from 6.1 > 6.3
I tried the same config on 6.2 which worked fine
I have another config for another LDAP server which works, so I think it's a combination of 6.3 + something about this specific AD server

0 Karma

guimilare
Communicator

Hi timhope,

Yes, we found the problem.
The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Hope this helps you.
Regards,

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

This message is indicative of being unable to connect to the ldap server / port specified in your configuration. I'd confirm you can connect to the LDAP server from the OS level. You can ping the server or telnet to 389 / 636 of the ldap server to validate this.

guimilare
Communicator

Hi esix,

Yeah, we can ping the LDAP server and telnet both 389 / 636...

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

If you can connect, make sure you config file specifies the correct host / ip address. Also, test with a known working good user account.

0 Karma

burwell
SplunkTrust
SplunkTrust

We use LDAP in Splunk 6.3.1 on our Search Heads in a Search Head Cluster and LDAP does work for us.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...