Splunk Enterprise

One User Cannot Authenticate to Splunk

pizzor
Path Finder

Having issues with one user trying to authenticate into Splunk. We're using LDAP auth.

  • User has the same primary group as another individual that can log in. That primary group is used to grant access to Splunk.
  • User does not have any other group memberships that are mapped in Splunk for authentication, so no conflicts that I can tell.
  • User is in the same OU as users that can authenticate.
  • Only have 1 LDAP strategy, and only this 1 user is affected.
  • Have confirmed that the user used for the LDAP strategy can query and see the affected user via Get-Aduser.

One thing I noticed in splunkd.log is the search filter appears a bit odd.

  • 09-10-2020 09:30:35.191 -0700 DEBUG AuthenticationManagerLDAP - Attempting to get roles for user="flastname" with DN="CN=Last\, First,OU=OU2,OU=OU1,OU=Users,DC=company,DC=com" in strategy="Company-LDAP-USERROLE"
  • 09-10-2020 09:30:35.194 -0700 ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="flastname". Search filter="(&(member=CN=Last\5C, First,OU=OU2,OU=OU1,OU=Users,DC=company,DC=com)(|(CN=USERROLE*)(CN=OTHERUSERROLE*)))" strategy="Company-LDAP-USERROLE"

In the filter I see what looks to be an added 5C, which is hex code for \ in ASCII. Is it adding an additional piece that shouldn't be there? Might be a red herring though.

Labels (1)
Tags (2)
0 Karma
1 Solution

pizzor
Path Finder

Alright, changed primary group to a different group (Domain Users) and they can log in now. Odd since the primary group for the affected user was the same as an unaffected user.

View solution in original post

0 Karma

pizzor
Path Finder

Alright, changed primary group to a different group (Domain Users) and they can log in now. Odd since the primary group for the affected user was the same as an unaffected user.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The backslash is escaping the comma embedded in the CN field so it is not interpreted as a field separator.

Have you tried passing the strings in those log messages to Get-Aduser to see if they work?

---
If this reply helps you, Karma would be appreciated.
0 Karma

pizzor
Path Finder

In the first log the backslash is escaping the comma, but in the second its escaping the literal 5C characters (it looks like).

I have tried using the query via Get-Aduser, but it receives no results. I also get no results when I swap out the CN for a user who is able to log into Splunk. I'm using get-aduser -LDAPFilter  and just copying/pasting the query from the log.

Edit: I tried creating a test user that I know would fail. The log was the same, except that it didn't have the \5C, instead just the escaped comma as I would expect.

09-10-2020 10:32:21.035 -0700 ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="splunkauthtest". Search filter="(&(member=CN=splunkauthtest,OU=OU2,OU=OU1,OU=Users,DC=company,DC=com)(|(CN=USERROLE*)(CN=OTHERUSERROLE*)))" strategy="Company-LDAP-USERROLE"

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...