Splunk Enterprise

One User Cannot Authenticate to Splunk

pizzor
Path Finder

Having issues with one user trying to authenticate into Splunk. We're using LDAP auth.

  • User has the same primary group as another individual that can log in. That primary group is used to grant access to Splunk.
  • User does not have any other group memberships that are mapped in Splunk for authentication, so no conflicts that I can tell.
  • User is in the same OU as users that can authenticate.
  • Only have 1 LDAP strategy, and only this 1 user is affected.
  • Have confirmed that the user used for the LDAP strategy can query and see the affected user via Get-Aduser.

One thing I noticed in splunkd.log is the search filter appears a bit odd.

  • 09-10-2020 09:30:35.191 -0700 DEBUG AuthenticationManagerLDAP - Attempting to get roles for user="flastname" with DN="CN=Last\, First,OU=OU2,OU=OU1,OU=Users,DC=company,DC=com" in strategy="Company-LDAP-USERROLE"
  • 09-10-2020 09:30:35.194 -0700 ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="flastname". Search filter="(&(member=CN=Last\5C, First,OU=OU2,OU=OU1,OU=Users,DC=company,DC=com)(|(CN=USERROLE*)(CN=OTHERUSERROLE*)))" strategy="Company-LDAP-USERROLE"

In the filter I see what looks to be an added 5C, which is hex code for \ in ASCII. Is it adding an additional piece that shouldn't be there? Might be a red herring though.

Labels (1)
Tags (2)
0 Karma
1 Solution

pizzor
Path Finder

Alright, changed primary group to a different group (Domain Users) and they can log in now. Odd since the primary group for the affected user was the same as an unaffected user.

View solution in original post

0 Karma

pizzor
Path Finder

Alright, changed primary group to a different group (Domain Users) and they can log in now. Odd since the primary group for the affected user was the same as an unaffected user.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The backslash is escaping the comma embedded in the CN field so it is not interpreted as a field separator.

Have you tried passing the strings in those log messages to Get-Aduser to see if they work?

---
If this reply helps you, Karma would be appreciated.
0 Karma

pizzor
Path Finder

In the first log the backslash is escaping the comma, but in the second its escaping the literal 5C characters (it looks like).

I have tried using the query via Get-Aduser, but it receives no results. I also get no results when I swap out the CN for a user who is able to log into Splunk. I'm using get-aduser -LDAPFilter  and just copying/pasting the query from the log.

Edit: I tried creating a test user that I know would fail. The log was the same, except that it didn't have the \5C, instead just the escaped comma as I would expect.

09-10-2020 10:32:21.035 -0700 ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="splunkauthtest". Search filter="(&(member=CN=splunkauthtest,OU=OU2,OU=OU1,OU=Users,DC=company,DC=com)(|(CN=USERROLE*)(CN=OTHERUSERROLE*)))" strategy="Company-LDAP-USERROLE"

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...