Security

LDAP in Free version work?

inhibitz
New Member

I have Free version Splunk. I have difficulty in setting LDAP authentication. I created the connection and the rights assigned to the user. but the user can not enter in web: error "is not a valid username or not such user." LDAP is working in the Free version?

Tags (1)
0 Karma

saravanan90
Contributor

Yes, it works with current Splunk trial version.

0 Karma

higuita
Engager

The free splunk do not have ldap (search free vs enterprise). Some people do a reverse proxy config with ldap authentication to workaround this.

The 30 days demo is really a enterprise version and after some fight i manage to put it working with a Windows Active Directory (AD)... but it will probably stop working after the 30days.

here is my config:

[AD]
SSLEnabled = 0
anonymous_referrals = 0
bindDN = domain\bindusername
bindDNpassword = encoded pass
charset = utf8
groupBaseDN = dc=ad-domain,dc=tld
groupBaseFilter = (objectclass=*)
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = DC-server.domain.pt
nestedGroups = 1
network_timeout = 20
port = 389
realNameAttribute = cn
sizelimit = 1000
timelimit = 15
userBaseDN = dc=ad-domain,dc=tld
userBaseFilter = (&(objectCategory=person)(objectClass=user)(mail=*))
userNameAttribute = samaccountname

My main error was the "Group mapping attribute" (ie: groupMappingAttribute in the config), where i put other things and the correct config is dn

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The Free version does not have functionality for LDAP or any other kind of user authentication.

inhibitz
New Member

but I get a log with errors:

04-06-2012 11:04:29.393 +0400 ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="user1". Search filter="(memberuid=uid=user1,ou=People,dc=domain,dc=com)" strategy="ldap1.int.domain.com"
04-06-2012 11:04:29.393 +0400 ERROR UserManagerPro - LDAP Login failed, could not find a valid user="user1" on any configured servers

ldap work???

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...