User LDAP Authentication with "Log On To" Workstation AD Restriction

[mzorzi]

We configured SPLUNK to use Active Directory as authentication system. Problem occurs with users that have "Log On To..." restrictions on the AD to restrict they ability to logon into Splunk from only a particular workstation.

Such user is unable to logon to the SPLUNK system, and the message returned is "Invalid username or password".

[dwaddle]

This seems to be a problem for many folks who use the "Log On To Workstation" restriction in conjunction with web-based applications (especially non-microsoft webapps using a non-IE browser). Some things that sound like they may work include:

1. Set the machine running SplunkWeb as one of the machines the user is permitted to Log On to
2. Set the AD Domain Controller as one of the machines the user is permitted to Log On to. Which is of course very undesirable.

It seems like this is the AD Domain controller actively denying logons. An all-Microsoft stack (IE in the browser, IIS on the server, and Active Directory) can solve this by passing Kerberos tickets from the client's workstation (where they have the log on right) through to web applications using NTLM / Domain authentication. (When it works, googling shows cases where apps like sharepoint don't handle this well either)

I think this is something that you should probably open a support case with Microsoft on. They will be best equipped to answer WTF AD is doing here.

If all else fails, define the user a local Splunk account using Splunk's native authentication. It stinks, but it works.

[nmistry_splunk]

is your splunk search head part of "log on to" computer group?