Unable to Configure LDAP Authentication.

Applicability

Description

While configuring the LDAP strategy the following message is received

ERROR ScopedLDAPConnection - strategy="My_Strategy" Error binding to LDAP. 
reason="Can't contact LDAP server"

Investigation

Troubleshooting steps:

1. Confirmed LDAP server was running fine and there was no connection issue between LDAP and Splunk.

2. Checked the configuration in the GUI and ldap.conf.

3. Tested LDAP configuration by executing the below command in the Command Line (CLI) to verify the variables being specified

ldapsearch -x –h <ldap_host> –p <ldap_port> –D "bind_dn" -w "bind_passwd" -b "user_basedn" 
"userNameAttribute=*"

Response: "result: 0 Success" 

4. Another attempt to configure LDAP settings, rendered the following message:

Failed to retrieve a user with these settings. Consult your LDAP admin or see splunkd.log
with ScopedLDAPConnection set to DEBUG for more information.

5. The LDAP strategy was created successfully. Logs:

DEBUG ScopedLDAPConnection - strategy="Cathay_LDAP" Bind successful

6. The groups were mapped to Splunk roles, Splunk was restarted, but login failed using one of the LDAP users.

7. Testing with an existing username and password was not successful. Error not able to connect AD

8. Verified the user is a service account and it has no sufficient privileges to access the Active directory.

9. Configuring the LDAP strategy with another username/password having sufficient privileges(can log in) and the LDAP configuration was successful.
 

Resolution

Splunk documentation indicates the user doesn't need administrator access, but this user needs to have read access to all LDAP user and group entries that are retrieved. Moreover, Splunk doesn't recommend using the service account as this might create issues due to insufficient/mismatch in privileges. Once the user gets all the read access to the users then the LDAP configuration will be done successfully.
 

Related Links

Test your LDAP configuration