All Apps and Add-ons

Splunk ldaptestconnection error

soumyasaha25
Contributor

i am trying to connect to my 2nd LDAP instance using the SA-LDAPSearch app (Splunk Supporting Add-on for Active Directory 3.0.1) and am getting the below error

External search command 'ldaptestconnection' returned error code 1. First 1000 (of 1921) bytes of script output: "error_message= # host: <hostname>: Could not access the directory service at ldaps://<hostname>:<ldaps_port>: ('unable to open socket', [(datetime.datetime(2020, 5, 18, 10, 57, 16, 524688), , LDAPSocketOpenError('socket connection error while opening: [Errno 110] Connection timed out',), ('<ip_address>', <ldaps_port>)), (datetime.datetime(2020, 5, 18, 10, 57, 31, 532624), , LDAPSocketOpenError('socket ssl wrapping error: [Errno 104] Connection reset by peer',), ('<ip_address>', <ldaps_port>)), (datetime.datetime(2020, 5, 18, 10, 59, 38, 860630), , LDAPSocketOpenError('socket connection error while opening: [Errno 110] Connection timed out',), ('<ip_address>', <ldaps_port>)), (datetime.datetime(2020, 5, 18, 10, 59, 53, 851213), , LDAPSocketOpenError('socket ssl wrapping error: [Errno 104] Connection reset by peer',), ('".

I do have a working ldap connection on a different domain that works fine and does not throw any error.
Is there any configs that i am missing or is it an issue with the connectivity from my splunk server to the ldap server?

0 Karma

PavelP
Motivator

Hello @soumyasaha25

there are two related errors which are repeated after the retry timeout:

LDAPSocketOpenError('socket connection error while opening: [Errno 110] Connection timed out',)
LDAPSocketOpenError('socket ssl wrapping error: [Errno 104] Connection reset by peer',)

Try this to find out if the reset is send on the TCP or on the SSL (TLS version, ciphers, certificate, cert path/CA, etc.) level:

openssl s_client -connect ldap_server_hostname:ldaps_port

alternatively run ldapsearch with -v flag

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...