Security

Unable to authenticate users in active directory

jeffwarn
Explorer

I have splunk configured to authenticate against AD. I have my service account set and the following options configured:

User Base DN: OU=Users,OU=My City,OU=North America,DC=us,DC=mydomain,DC=com

User Name Attribute: samaccountname

Group Mapping: memberof

Group Base DN: OU=Groups,OU=My City,OU=North America,DC=us,DC=mydomain,DC=com

Group Name Attribute: cn

Group Member Attr: member

Once saved, I can get a list of my groups just fine when I click on the "Configure LDAP Role Mapping" link. This is where it gets strange. I have a few users in a group called "Product Ops". In this group, there are about 10 users defined (example):

CN=Some Person,OU=Users,OU=My City,OU=North America,DC=us,DC=mydomain,DC=com

I assign this group "Product Ops" to the user role and click save. No users are able to log in and I find something like this in the logs:

splunkd.log:03-14-2011 16:04:09.722 WARN AuthenticationManagerLDAP - User 'someuser' had 6 values for mapping attribute 'memberof'. Group members should be uniquely defined.

splunkd.log:03-14-2011 16:04:09.724 ERROR AuthenticationManagerLDAP - User 'someuser' has matching LDAP groups, but none are mapped to Splunk roles

Now if I added a new group in my AD called "Splunk Users" and instead of putting the user directly into the group and just move the "Product Ops" into is, the user can log in just fine.

What am I missing here? I'm at the point where I'd much rather just link individual users from AD to splunk roles (can this be done?)

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The Group Mapping attribute in AD should be left blank, or set to "distinguishedName" or "dn". This attribute specifies what field within the user record maps to the Group Member Attribute within the group. In AD (and LDAP in general) groups are not stored on the user object, but on the group object. The AD users memberof attribute is a synthetic attribute based on the group member attribute

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The Group Mapping attribute in AD should be left blank, or set to "distinguishedName" or "dn". This attribute specifies what field within the user record maps to the Group Member Attribute within the group. In AD (and LDAP in general) groups are not stored on the user object, but on the group object. The AD users memberof attribute is a synthetic attribute based on the group member attribute

jeffwarn
Explorer

Thanks that did it. On a side note, that actually broke the way it was working (embedded groups), but I saw that technically isn't supported at the moment.

0 Karma

praveenkpatidar
Explorer

Perfect It works for me after 3 days of headache.
THanks a ton !!!

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...