ERROR: 'login failed', 'Page not found 404', 'could not find a valid user' and 'Invalid credentials'

Applicability

Description

When trying to log into Splunk using an Active Directory (ADSI) account,  the message 'login failed' is received.

It appears to be an authentication problem with Active Directory.

Log in using the local Splunk Admin account is possible.


 

Investigation

There were two LDAP (Active Directory) Servers.  The error messages received in the splunkd.log files were as follows:


"ldap1" (Primary LDAP Server)

50814 09/24/2019 18:00:20.835 10/01/2019 09:00:42.171 splunkd ERROR ScopedLDAPConnection 10-01-2019 12:00:42.171 +0300 ERROR ScopedLDAPConnection - 
strategy="ldap1" Error binding to LDAP. reason="Invalid credentials"1 09/30/2019 05:30:39.009 09/30/2019 05:30:39.009 splunkd WARN ScopedLDAPConnection 09-30-2019 08:30:39.009 +0300 WARN ScopedLDAPConnection - 
strategy="ldap1" Bind took longer than seems reasonable (15034 milliseconds). Might indicate slow ldap server.Bind took longer than seems reasonable (15034 milliseconds). Might indicate slow ldap server.

"ldap2" (Secondary LDAP Server)

50814 09/24/2019 18:00:20.841 10/01/2019 09:00:42.175 splunkd ERROR ScopedLDAPConnection 09-29-2019 10:20:29.846 +0300 ERROR ScopedLDAPConnection - 
strategy="ldap2" Error binding to LDAP. reason="Invalid credentials"

COUNT EARLIEST LATEST SOURCETYPE LOG_LEVEL COMPONENT MESSAGE punct

101628 09/24/2019 18:00:20.835 10/01/2019 09:00:42.175 splunkd ERROR ScopedLDAPConnection 09-29-2019 10:20:29.846 +0300 ERROR ScopedLDAPConnection - 
strategy="ldap2" Error binding to LDAP. reason="Invalid credentials"163 09/28/2019 00:01:13.334 10/01/2019 09:01:13.093 splunkd WARN SearchOperator:inputcsv 09-29-2019 10:01:14.767 +0300 WARN SearchOperator:inputcsv - sid: 
The lookup table 'ldap_auto_identities_lookup' is invalid.16 09/25/2019 10:29:32.567 10/01/2019 08:41:47.927 splunkd ERROR UserManagerPro 09-30-2019 09:46:56.503 +0300 ERROR UserManagerPro - LDAP Login failed, 
could not find a valid user="peter" on any configured servers2 09/30/2019 06:42:04.005 09/30/2019 06:42:04.005 splunkd ERROR UserManagerPro 09-30-2019 09:42:04.005 +0300 ERROR UserManagerPro - LDAP Login failed, 
could not find a valid user="support" on any configured servers2 09/25/2019 10:30:10.113 09/25/2019 10:30:10.113 splunkd ERROR UserManagerPro 09-25-2019 13:30:10.113 +0300 ERROR UserManagerPro - LDAP Login failed, 
could not find a valid user="adserver\bob" on any configured servers1 09/30/2019 05:30:39.009 09/30/2019 05:30:39.009 splunkd WARN ScopedLDAPConnection 09-30-2019 08:30:39.009 +0300 WARN ScopedLDAPConnection - 
strategy="ldap1" Bind took longer than seems reasonable (15034 milliseconds). Might indicate slow ldap server.1 09/25/2019 10:30:20.406 09/25/2019 10:30:20.406 splunkd ERROR UserManagerPro 09-25-2019 13:30:20.406 +0300 ERROR UserManagerPro - LDAP Login failed, 
​​​​​​​could not find a valid user="bob@company.com" on any configured servers

Concerning the following error message an attempt to reauthenticate the LDAP/ADSI strategy in Windows was made to ensure it had not been locked out and the password had not expired.

ERROR ScopedLDAPConnection "Error binding to LDAP. reason="Invalid credentials"" 

authentication.conf had been reviewed and bindDN, groupBaseDN, userBaseDN did not match the OU (Organisational Unit) values in the Active Directory.


 

Resolution

The Organizational Unit (OU) values had been changed in the Active Directory by a team member and the values no longer matched what was in authentication.conf.

Once the Organizational Unit (OU) values in the authentication.conf file was modified to match those in the Active Directory, it was possible to log in using an Active Directory user account.