Splunk should connect to AD global catalog (tcp:3269) by default

Ever had a 10 minute delay logging into splunk via AD -> LDAPS authentication over port 636? It's probably because of "active directory forest referrals", which bog down LDAPS queries.

The trick is to tell splunk to use the "global catalog" port (tcp:3269), which causes this referral delay to not occur.

This should be documented, somewhere.

asked 16 Nov '11, 18:02

kindlund
31●4
accept rate: 0%

edited 07 Feb '12, 12:43

piebob ♦♦
4.6k●4●10●23

Be the first one to answer this question!

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

ldap ×125
activedirectory ×74
ldaps ×1

Asked: 16 Nov '11, 18:02

Seen: 845 times

Last updated: 07 Feb '12, 12:43

Splunk should connect to AD global catalog (tcp:3269) by default

Follow this question

Splunk Resources

Related questions