What is LdapErr: DSID-0C0906DD ... In order to perform this op a successful bind must be completed?

[the_wolverine]

In configuring Splunk to use LDAP, I'm seeing the following error in splunkd.log:

ERROR authenticationManagerLDAP - Text '000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1771

I've provided a valid bindDN and password so what is the problem? I'm unable to see any users/groups in Splunk.

[the_wolverine · Accepted solution]

This error points to an issue with referrals in AD. Splunk currently does not support LDAP referrals and a workaround is documented. Refer to the top of the LDAP configuration section of our document for a pointer to the workaround.

The problem may be that your configuration is too broad and thus triggers AD referrals. Oftentimes, you can sidestep this specifying a more specific DN and using LDAP filters.

If that doesn't work you may need to resort to using the AD GC (Global Catalog) port (if implemented.)