Security
Highlighted

LDAP authentication not working on Splunk version 6.3.1

Communicator

Hello Splunkers,

I have a Splunk environment runnning on cluster.
My indexers (7 peers) were at version 6.1.3 and my search heads (6 SHs) at version 6.2.3.
The autenthication is done by LDAP.

We updated all servers to Splunk version 6.3.1 .
But now I'm not able to connect to LDAP.

The error message is:

An error occurred completing this request: In handler 'LDAP-groups : strategy="Server"' Error binding to LDAP. reason="Can't connect to LDAP server".

Have anyone experienced this issue?
I think this may be a bug.

Thanks in advance.
Best regards

Highlighted

Re: LDAP authentication not working on Splunk version 6.3.1

SplunkTrust
SplunkTrust

We use LDAP in Splunk 6.3.1 on our Search Heads in a Search Head Cluster and LDAP does work for us.

0 Karma
Highlighted

Re: LDAP authentication not working on Splunk version 6.3.1

Splunk Employee
Splunk Employee

This message is indicative of being unable to connect to the ldap server / port specified in your configuration. I'd confirm you can connect to the LDAP server from the OS level. You can ping the server or telnet to 389 / 636 of the ldap server to validate this.

Highlighted

Re: LDAP authentication not working on Splunk version 6.3.1

Communicator

Hi esix,

Yeah, we can ping the LDAP server and telnet both 389 / 636...

0 Karma
Highlighted

Re: LDAP authentication not working on Splunk version 6.3.1

Splunk Employee
Splunk Employee

If you can connect, make sure you config file specifies the correct host / ip address. Also, test with a known working good user account.

0 Karma
Highlighted

Re: LDAP authentication not working on Splunk version 6.3.1

New Member

Hey, any resolution? I'm now getting the same issue going from 6.1 > 6.3
I tried the same config on 6.2 which worked fine
I have another config for another LDAP server which works, so I think it's a combination of 6.3 + something about this specific AD server

0 Karma
Highlighted

Re: LDAP authentication not working on Splunk version 6.3.1

Communicator

Hi timhope,

Yes, we found the problem.
The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Hope this helps you.
Regards,

0 Karma
Highlighted

Re: LDAP authentication not working on Splunk version 6.3.1

Communicator

Problem solved.

The problem is related to the opnessl version with Microsoft 2003 AD.

Adding the following cipher list to the $SPLUNK_HOME/etc/openldap/ldap.conf fixed the error:

TLS_CIPHER_SUITE HIGH:MEDIUM:@STRENGTH:+3DES:+RC4:!aNULL:!MD5:!SRP:!PSK:!aDSS:!kECDH:!kDH:!SEED,!IDEA:!RC2:!RC5

Regards,
guimilare

View solution in original post