错误：'登录失败'、'找不到页面404'、'找不到有效用户'和'凭证无效'

适用范围

描述

尝试使用Active Directory(ADSI)帐户登录Splunk时，会收到消息“login failed”。

这似乎是Active Directory的身份验证问题。

可以使用本地Splunk Admin帐户登录。


 

调查

有两个LDAP(Active Directory)服务器。  splunkd.log文件中收到的错误消息如下：


"ldap1"（主LDAP服务器）

50814 09/24/2019 18:00:20.835 10/01/2019 09:00:42.171 splunkd ERROR ScopedLDAPConnection 10-01-2019 12:00:42.171 +0300 ERROR ScopedLDAPConnection - 
strategy="ldap1" Error binding to LDAP. reason="Invalid credentials"1 09/30/2019 05:30:39.009 09/30/2019 05:30:39.009 splunkd WARN ScopedLDAPConnection 09-30-2019 08:30:39.009 +0300 WARN ScopedLDAPConnection - 
strategy="ldap1" Bind took longer than seems reasonable (15034 milliseconds). Might indicate slow ldap server.Bind took longer than seems reasonable (15034 milliseconds). Might indicate slow ldap server.

"ldap2"（辅助LDAP服务器）

50814 09/24/2019 18:00:20.841 10/01/2019 09:00:42.175 splunkd ERROR ScopedLDAPConnection 09-29-2019 10:20:29.846 +0300 ERROR ScopedLDAPConnection - 
strategy="ldap2" Error binding to LDAP. reason="Invalid credentials"

COUNT EARLIEST LATEST SOURCETYPE LOG_LEVEL COMPONENT MESSAGE punct

101628 09/24/2019 18:00:20.835 10/01/2019 09:00:42.175 splunkd ERROR ScopedLDAPConnection 09-29-2019 10:20:29.846 +0300 ERROR ScopedLDAPConnection - 
strategy="ldap2" Error binding to LDAP. reason="Invalid credentials"163 09/28/2019 00:01:13.334 10/01/2019 09:01:13.093 splunkd WARN SearchOperator:inputcsv 09-29-2019 10:01:14.767 +0300 WARN SearchOperator:inputcsv - sid: 
The lookup table 'ldap_auto_identities_lookup' is invalid.16 09/25/2019 10:29:32.567 10/01/2019 08:41:47.927 splunkd ERROR UserManagerPro 09-30-2019 09:46:56.503 +0300 ERROR UserManagerPro - LDAP Login failed, 
could not find a valid user="peter" on any configured servers2 09/30/2019 06:42:04.005 09/30/2019 06:42:04.005 splunkd ERROR UserManagerPro 09-30-2019 09:42:04.005 +0300 ERROR UserManagerPro - LDAP Login failed, 
could not find a valid user="support" on any configured servers2 09/25/2019 10:30:10.113 09/25/2019 10:30:10.113 splunkd ERROR UserManagerPro 09-25-2019 13:30:10.113 +0300 ERROR UserManagerPro - LDAP Login failed, 
could not find a valid user="adserver\bob" on any configured servers1 09/30/2019 05:30:39.009 09/30/2019 05:30:39.009 splunkd WARN ScopedLDAPConnection 09-30-2019 08:30:39.009 +0300 WARN ScopedLDAPConnection - 
strategy="ldap1" Bind took longer than seems reasonable (15034 milliseconds). Might indicate slow ldap server.1 09/25/2019 10:30:20.406 09/25/2019 10:30:20.406 splunkd ERROR UserManagerPro 09-25-2019 13:30:20.406 +0300 ERROR UserManagerPro - LDAP Login failed, 
​​​​​​​could not find a valid user="bob@company.com" on any configured servers

对于以下错误消息，已尝试在Windows中重新验证LDAP/ADSI策略，以确保该策略未被锁定且密码未过期。

ERROR ScopedLDAPConnection "Error binding to LDAP. reason="Invalid credentials"" 

authentication.conf已经过审核，并且bindDN、groupBaseDN、userBaseDN与Active Directory中的OU（组织单位）值不匹配。


 

分辨率

Organizational Unit(OU)值已由团队成员在Active Directory中更改，并且这些值不再与authentication.conf中的值匹配。

authentication.conf文件中的组织单位(OU)值修改为与Active Directory中的值匹配后，可以使用Active Directory用户帐户登录。