Security

Problem logging into splunk

lain179
Communicator

Hi,

I have been using the same credential to login to my Splunk, but all of a sudden it stops working this afternoon. The log shows the following error. I know my password is correct because it's my AD account and I use the same pwd to login to my computer. How can I troubleshoot this login problem?

Thanks.

2013-04-03 14:52:55,190 ERROR   [515ca4b6f952fec88] account:216 - user=xxx action=login status=failure reason=user-initiated useragent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; InfoPath.3)" clientip=xx.xx.x.xxx
Tags (1)

nurtdi
Path Finder

This is only affecting AD users

0 Karma

Voltaire
Communicator

Are you using LDAP to authenticate to AD with Splunk??

0 Karma

Voltaire
Communicator

If it is Splunk, yu can change the password here "$SPLUNKHOME/etc/passwd" Restart splunk and login with the Splunk default password

0 Karma

Voltaire
Communicator

Are you using Splunk and or LDAP to authenticate?

0 Karma

Voltaire
Communicator

Did you configure LDAP roles in Splunk for authentications? If yes, did you use LDAP search method or another utility to verify the LDAP attributes in configuring the "LDAP connection settings"
For example did you verify The Group base DN? Exaple
"OU=Security Groups - AIS,DC=ad,DC=it,DC=yourdc,DC=ext

0 Karma

nurtdi
Path Finder

Yes! I see the issue with AD users.
the search-heads have same error as in original question. and it is not a single server that has an issue.
This search 'index=_* "action=login status=failure" | stats count by user reason date_month date_mday date_wday date_hour host' sorts it out and I can see different users and different hosts with the error - all intermittent.

0 Karma

nurtdi
Path Finder

We have the same issue - did you find anything on this? thanks

0 Karma

lain179
Communicator

That only has a list of the accounts created in Splunk. Not AD accounts. Other people from same AD group don't have any problem logging in.

0 Karma

vincesesto
Communicator

Hey lain179,
I am not sure how splunk works with DA, but have you had a look at the passwd file that holds default user details in:
$SPLUNKHOME/etc/passwd
Might be somewhere to start.
Regards Vince

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...