Test your LDAP configuration on Splunk Enterprise

If, after you configure Splunk Enterprise to use the lightweight directory access protocol (LDAP) as an authentication scheme, you then determine that it cannot connect to your LDAP server, follow these steps to troubleshoot the problem:

1. Check the $SPLUNK_HOME/var/log/splunk/splunkd.log file for authentication errors. For additional information, you can turn on DEBUG-level logging for the AuthenticationManagerLDAP facility. You can do this from the "Server Settings/Server Logging" configuration page in Splunk Web.
2. Remove any custom values that you might have added for the userBaseFilter and groupBaseFilter settings for the LDAP strategy that you have configured in the authentication.conf configuration file.
3. On *nix machines, you can use the ldapsearch command-line tool to confirm that the variables you specify return the expected entries. See the following examples:

ldapsearch -x –h <ldap_host> –p <ldap_port> –D "bind_dn" -w "bind_passwd" -b "user_basedn" "userNameAttribute=*"

ldapsearch -x –h <ldap_host> –p <ldap_port> –D "bind_dn" -w "bind_passwd" –b "group_basedn" "groupNameAttribute=*"

If these commands return matching entries, then your have properly configured your backend LDAP system. Continue to troubleshoot the Splunk LDAP strategy configuration.