LDAP authentication not working on Splunk version 6.3.1

[guimilare]

Hello Splunkers,

I have a Splunk environment runnning on cluster.
My indexers (7 peers) were at version 6.1.3 and my search heads (6 SHs) at version 6.2.3.
The autenthication is done by LDAP.

We updated all servers to Splunk version 6.3.1 .
But now I'm not able to connect to LDAP.

The error message is:

An error occurred completing this request: In handler 'LDAP-groups : strategy="Server"' Error binding to LDAP. reason="Can't connect to LDAP server".

Have anyone experienced this issue?
I think this may be a bug.

Thanks in advance.
Best regards

[guimilare · Accepted solution]

Problem solved.

The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Regards,
guimilare

[timhope]

Hey, any resolution? I'm now getting the same issue going from 6.1 > 6.3
I tried the same config on 6.2 which worked fine
I have another config for another LDAP server which works, so I think it's a combination of 6.3 + something about this specific AD server

[guimilare]

Hi timhope,

Yes, we found the problem.
The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Hope this helps you.
Regards,

[esix_splunk]

This message is indicative of being unable to connect to the ldap server / port specified in your configuration. I'd confirm you can connect to the LDAP server from the OS level. You can ping the server or telnet to 389 / 636 of the ldap server to validate this.

[guimilare]

Hi esix,

Yeah, we can ping the LDAP server and telnet both 389 / 636...

[esix_splunk]

If you can connect, make sure you config file specifies the correct host / ip address. Also, test with a known working good user account.

[burwell]

We use LDAP in Splunk 6.3.1 on our Search Heads in a Search Head Cluster and LDAP does work for us.