LDAP authentication performing slow

Applicability

Splunk Enterprise

Description

Users were having very slow performance when using LDAP as an authentication method.
 

Investigation

LDAP:
LDAP, or Lightweight Directory Access Protocol, is an open protocol used to store and retrieve data from a hierarchical directory structure. Commonly used to store information about an organization and its assets and users, LDAP is a flexible solution for defining any type of entity and its qualities.

Directory Service:
A directory service is used to store, organize and present data in a key-value type format. Typically, directories are optimized for lookups, searches, and read operations over write operations, so they function extremely well for data that is referenced often but changes infrequently.

LDAP, or lightweight directory access protocol, is a communications protocol that defines the methods in which a directory service can be accessed. More broadly speaking, LDAP shapes the way that the data within a directory service should be represented to users, defines requirements for the components used to create data entries within a directory service, and outlines the way that different primitive elements are used to compose entries. Attributes:
The data itself in an LDAP system is mainly stored in elements called attributes. Attributes are basically key-value pairs.

Entries:
Attributes by themselves are not very useful. To have meaning, they must be associated with something. Within LDAP, you use attributes within an entry. An entry is basically a collection of attributes under a name used to describe something.

For instance, you can have an entry for a user in your system or for each item in an inventory. This is roughly analogous to a row in a relational database system or to a single page within an address book (the attributes here would represent the various fields in each of these models). While an attribute defines a quality or characteristic of something, an entry describes the item itself by simply collecting these attributes under a name.

Entries are all added to an LDAP system as branches on trees called Data Information Trees, or DITs.

A DIT represents an organizational structure similar to a file system where each entry (other than the top-level entry) has exactly one parent entry and may have any number of child entries beneath it. Since entries in an LDAP tree can represent just about anything, some entries will be used mainly for organizational purposes, similar to directories within a filesystem.

For example:

dn: sn=Ellingwood,ou=people,dc=digitalocean,dc=com

This line is called the entry's distinguished name (more on this later) and is used to identify the entry. It functions like a full path back to the root of the DIT. In this instance, we have an entry called sn=Ellingwood, which we are creating. The direct parent is an entry called ou=people which is probably being used as a container for entries describing people. The parents of this entry derived from the digitalocean.com domain name, which functions as the root of our DIT.Reference: https://www.digitalocean.com/community/tutorials/understanding-the-ldap-protocol-data-hierarchy-and-entry-components

LDAP authetication in Splunk in the end is querying a database and this query could be very broad if you don't set the right configurations in 
authetication.conf In the authetication.conf specification you can find out the following:

userBaseFilter = <string>
* OPTIONAL
* This is the LDAP search filter you wish to use when searching for users.
* Highly recommended, especially when there are many entries in your LDAP
  user subtrees
* When used properly, search filters can significantly speed up LDAP queries
* Example that matches users in the IT or HR department:
    * userBaseFilter = (|(department=IT)(department=HR))
    * See RFC 2254 for more detailed information on search filter syntax
* This defaults to no filtering.

This in turn allows to narrow down the amount of entries that the query needs to search on because it filters allows to look only into certain entries in the user subtrees.

Resolution

User had a userBasefilter like the following:

userBaseFilter = (|(department=VP30)(department=VPIN)(department=VA02))

The users that were observing this slow performance maybe didn't belong to all the departments listed in the original userBaseFilter. Remove one or two departments so that each time an authentication would happen, the searches would be less broad because the LDAP server would only need to check entries of one department.
 

Related Links

Splunk Answers:

Why is LDAP authentication failing with "size limit exceeded" errors using Splunk 6.2 on Windows 2008 R2?
https://answers.splunk.com/answers/179797/why-is-ldap-authentication-failing-with-size-limit.html

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release