Splunk LDAP Authentication Failures – Error Binding to LDAP (“Invalid credentials”)

Applicability

Description

LDAP users cannot login

Investigation

To determine whether the failure is due to the Bind DN (service account) or the user credentials, enable DEBUG logging for LDAP authentication:

category.AuthenticationManagerLDAP=DEBUG
category.ScopedLDAPConnection=DEBUG

Case 1 – Bind DN issue

If the log shows:

Attempting bind as DN="<BindDN here>"
ERROR ... reason="Invalid credentials"

Example:

DEBUG ScopedLDAPConnection [12345 TcpChannelThread] - strategy="corp-LDAP" Initializing with LDAPURL="ldaps://ldap01.corp.example.com:636"
DEBUG ScopedLDAPConnection [12345 TcpChannelThread] - strategy="corp-LDAP" Attempting bind as DN="CN=Splunk-LDAP-Bind,OU=Service Accounts,DC=corp,DC=example,DC=com"
ERROR ScopedLDAPConnection [12345 TcpChannelThread] - strategy="corp-LDAP" Error binding to LDAP. reason="Invalid credentials"

Case 2 – User credentials/state issue

If the log shows:

Attempting bind as DN="CN=<username>..."
ERROR ... reason="Invalid credentials"

Example:

DEBUG ScopedLDAPConnection [12345 TcpChannelThread] - strategy="ldap-strategy" Attempting bind as DN="CN=John Smith,OU=ABC,DC=ABC,DC=splunk,DC=net"
ERROR ScopedLDAPConnection [12345 TcpChannelThread] - strategy="ldap-strategy" Error binding to LDAP. reason="Invalid credentials"

This means the user’s password or account state is causing the failure (wrong password, expired, locked out, “must change password,” “smart card required,” or logon restrictions).

Case 3 – bindDNpassword decryption failure

If the log shows:

WARN AuthenticationProviderLDAP ... Unable to decrypt authentication.conf/[strategy]/bindDNpassword

Cause: The encrypted password in authentication.conf was copied from another host and cannot be decrypted with this host’s splunk.secret.

Resolution: Re-enter the Bind DN password on this host (UI or CLI) and restart Splunk.

authentication.conf
[sample-strategy]
bindDNpassword = <encrypted_strings>

Resolution

• For Bind DN issues: Confirm with LDAP/AD team whether the Bind DN account is valid and allowed to bind from this host.

• For user credential issues: Confirm the user’s account state and password; test with ldapwhoami or ldapsearch from the Splunk host.

• For bindDNpassword decryption issues: Re-enter the password locally.

Reference docs:

Configure LDAP using configuration files

Configure LDAP with Splunk Web

The Key parameters for authentication.conf:

bindDN = 
bindDNpassword = 
groupBaseDN = 
host = 
userBaseDN = 

Example: Successful login flow
1. Login workflow starts

07:35:23.465 DEBUG UserManagerPro ... Login work for user "12345678" started
07:35:23.465 DEBUG AuthenticationProviderLDAP ... Attempting to get user information for user="12345678"

2. Bind as the service account (Bind DN) for lookup/search

07:35:23.465 DEBUG ScopedLDAPConnection ... Initializing with LDAPURL="ldaps://splunk-haproxy...:3269"
07:35:23.465 DEBUG ScopedLDAPConnection ... Attempting bind as DN="CN=Infodir-UK-Splunk,OU=Service Accounts,..."
07:35:23.603 DEBUG ScopedLDAPConnection ... Bind successful

3. Find the user object

07:35:23.603 DEBUG ScopedLDAPConnection ... search subtree at DN="OU=abcPeople,..." filter="(&(employeeid=12345678)(displayname=*))"
07:35:23.624 DEBUG ScopedLDAPConnection ... Loading entry attributes for DN="CN=12345678,OU=abcPeople,..."
07:35:23.624 DEBUG ScopedLDAPConnection ... Adding attribute="displayName" ...
07:35:23.624 DEBUG ScopedLDAPConnection ... Adding attribute="mail" ...

4. (Optional secondary base) Checks Service Accounts OU too

07:35:23.624 DEBUG ScopedLDAPConnection ... search subtree at DN="OU=Service Accounts,..." filter="(&(employeeid=12345678)(displayname=*))"

5. Map groups for the user

07:35:23.644 DEBUG AuthenticationProviderLDAP ... Attempting to get roles for user="12345678" with DN="CN=12345678,OU=abcPeople,..."
07:35:23.644 DEBUG ScopedLDAPConnection ... search subtree at DN="OU=Splunk,OU=Applications,OU=Groups,..." filter="(&(member=CN=12345678,OU=abcPeople,...)(cn=*))"
07:35:23.666-07:35:23.667 DEBUG ScopedLDAPConnection ... Loading entry attributes for DN="CN=Infodir-<various groups>..."
07:35:23.666 DEBUG AuthenticationProviderLDAP ... Found matching group="Infodir-Splunk_Digital_infra_admin" with mapped roles

6. Finish info fill & close the lookup bind

07:35:23.667 DEBUG AuthenticationProviderLDAP ... Successfully filled info for user="12345678" with realname="..." and email="..."
07:35:23.667 DEBUG ScopedLDAPConnection ... Successfully performed unbind

7. Re-bind as the user DN to verify password (the actual authentication)

07:35:23.667 DEBUG AuthenticationProviderLDAP ... Caching user="12345678" with DN="CN=12345678,OU=abcPeople,..."
07:35:23.667 DEBUG UserManagerPro ... Login: Found user="12345678"... Attempting to bind as their DN="CN=12345678,OU=abcPeople,..."
07:35:23.667 DEBUG ScopedLDAPConnection ... Initializing with LDAPURL="ldaps://splunk-haproxy...:3269"
07:35:23.667 DEBUG ScopedLDAPConnection ... Attempting bind as DN="CN=12345678,OU=abcPeople,..."
07:35:24.829 DEBUG ScopedLDAPConnection ... Bind successful

8. Success + cleanup

07:35:24.830 INFO  UserManagerPro ... Login success for user="12345678", elapsed time=1.364 seconds
07:35:24.830 DEBUG UserManagerPro ... user="12345678" successfully logged in
07:35:24.830 DEBUG ScopedLDAPConnection ... Successfully performed unbind