Error while integrating Splunk with LDAP

[franciscof]

Hi guys, I´ve been trying to integrate Splunk with LDAP but I´m encountering this error:

franciscof_1-1613056179057.png

What could this be?

Thanks in advance

[scelikok]

Hi @franciscof,

Yes, Splunk first check if local users matches.  You can check the usernames/groups that comes from LDAP authentication on Setting | Users page. You will see all users with mapped roles and "Authentication System"

You may need to check the setting on "User name attribute"  inside LDAP Strategy. It is usually "samaccountname".

[scelikok]

Did you map groups to roles? Required LDAP groups should be mapped to a Splunk Role.

You can find documentation below;

https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/MapLDAPgroupstoSplunkroles 

[franciscof]

Yes I did. My local user is the same as my LDAP user, could that be causing trouble? However, there are other users that have different local and LDAP users and they also cannot log in.

[scelikok]

Hi @franciscof,

You may need to uncheck if "Enable referrals with anonymous bind only"  in Advanced settings;

scelikok_0-1613062506873.png

[franciscof]

That solved the error, but even though the configuration is OK, Splunk is not authenticating through LDAP. I can only access Splunk through my local user. What could this be?