All Apps and Add-ons

Why does Splunk Support for Active Directory 2.1.2 still throw admin_all_capability permissions errors when non-admin users run searches?

lohitkidu
Path Finder

Hi All ,

I have installed Splunk Support for Active Directory 2.1.2 in our search head cluster and search peers. Non-admin users are not able to search and getting following error:

File=configuration.py, Line=508, Storage password "SA-ldapsearch:default:" access denied: HTTP 403 Forbidden --
 In handler 'passwords': You (user=test) do not have permission to perform this operation (requires capability: admin_all_objects).

Though it is a bad practice, but the password in ldap.conf is in clear text. I thought this issue would have resolved in 2.1.2?

Any ideas ?

srinathd
Contributor

Make sure that the user that you log into Splunk Enterprise as has the admin_all_objects capability. This capability must be present because the configuration page saves passwords as storage passwords, and only this capability allows users to read storage passwords.

If you cannot grant the admin_all_objects capability, as a workaround, you can use a clear-text password and obfuscate that password with base-64 encoding(password prefixed with {64} will encode). In this case, however, you can not use the configuration page to save the password nor can you test the connection. This is because the configuration page moves any clear-text passwords to storage passwords when you save the configuration.

You must edit ldap.conf with a text editor and save the password(s) that way, and then use the ldaptestconnection command to test the configuration.

0 Karma

lohitkidu
Path Finder

Also I see different passwords in ldap.conf under default stanza(which i am using) and in passwords.conf under [credential:SA-ldapsearch:default:] stanza.

0 Karma

lohitkidu
Path Finder

Though I have used test connection via the configuration page. Would even that move my clear-text password to storage password. I can see my clear text password in ldap.conf for now ?

0 Karma

lohitkidu
Path Finder

I already have this fix couple of versions back. In my environment, non-admin users are getting results for ldapsearch command with error
External search command 'ldapsearch' returned error code 1. Script output = " ERROR "000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1" "

While for ldapfilter command no results are returned.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...