Where is the LDAP service account set in the SolarWinds Platform?

I have inherited a SolarWinds instance. There is a service account that binds the instance to AD with LDAP. The account password will expire in 30 days. I have been searching for the last few days, and I have not seen where that account is established. I would have assumed that it would be set in the Advanced AD settings selection, in the User Accounts section. Suggestions?

Find more posts tagged with

ldap

service account

ad authenticated

Accepted answers

All comments

cheryl1

Hi there

Let me see if I can help you, but first let me clarify a few things to be sure I understand the problem. LDAP authentication is most commonly used in the SolarWinds software when the server is not or cannot be on the domain you wish to use for user accounts. Advanced AD settings are all about configuring LDAP, and the only "account" used there is an AD account you can use to "test" and verify the LDAP configurations against the DC information you entered. Unlike using a service account to poll entities, an expiration on the password does not affect the LDAP functionality, as it doesn't use the account to "authenticate" and allow user access. Configuring LDAP just switches the connection "protocol" from MSAPI to LDAP, often needed for AD communication outside the domain.

That AD account could be in the User Accounts section, but if it is in a Windows Group (seen under the Groups tab) and not added as a Windows Individual Account, you won't see the account itself. When groups are added, only the groups are seen in the web console, not the users in those groups. But again, the account expiring doesn't affect the LDAP communication to the DC.

That said, I need a little more clarity on what you mean by "binding" the instance to AD using LDAP. Where are you seeing that? Or has this explanation cleared up your question?

Poirot

Thank you for the reply. I am not an AD person, but a network engineer. I have checked all the locations where the account should be and it is not there. I would have assumed that it would be in the Windows Credentials or Advanced AD settings.

As far as the account expiring, it is set up in AD to expire every 6 months or so.

When I mean bind, I mean add/attach to our domain.

When I log in with my privledged account, there is no local account in SW, so it has to ask AD. In other apps I have used, there is a service account that facilitates communications with the AD server. As I said, this is inherited, and I am trying to figure this out.

Lofstrand

Hi @Poirot

I think it works like this: As SolarWinds Observability self hosted is installed on a Windows server that is a member of the AD, and we use .net code, it's using the computers account to read the domain.

For example in DPA that is a java-application, it has to have a domain account to be able to read the domain. Here we don't need that, so there is no account stored to talk to the domain in the software.