Security

Need more info about LDAP authorization internals

robgarner
Path Finder

Hi -

I have a working LDAP authentication/authorization configuration. There are no local users - all access is based on LDAP group membership and associated role definitions. A couple of our roles import "power" role. A couple of roles import other roles that import "power". There are multiple AD and OpenLDAP stores and some users are members of dozens of groups. Some of the LDAP groups import other LDAP groups (which a couple of "Answer" topics have indicated can be problematic).

1) I'd like guidance on constructing a query (preferably REST, but I'm not too fussy) that will show me which roles are importing "power" (or any other role or permssion, for that matter). Recursive would be icing on the cake.

2) Is there any equivalent of a "debug verbose" flag I can turn on in Splunk itself for authentication/authorization that will log all requests to and results from the LDAP servers ? I'm hoping for the equivalent of the "-d 1" flag for ldapsearch.

Thanks,
-Rob

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

Try starting with something like this and see what you want to do search-wise to drive to your answer.

| rest splunk_server=local /services/authorization/roles
| table title imported_roles
| rename title AS role

The splunk_server=local is going to show just that search head. If you remove that, it will return your indexers as well so you'll need to consolidate those results.

Let us know how that works out and we can iterate through.

Reference: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTaccess#authorization.2Froles

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Try starting with something like this and see what you want to do search-wise to drive to your answer.

| rest splunk_server=local /services/authorization/roles
| table title imported_roles
| rename title AS role

The splunk_server=local is going to show just that search head. If you remove that, it will return your indexers as well so you'll need to consolidate those results.

Let us know how that works out and we can iterate through.

Reference: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTaccess#authorization.2Froles

0 Karma

robgarner
Path Finder

Many thanks on the rest query; that'll get me started on the roles question.

How about LDAP troubleshooting; do you have any insight on how I could approach that ?

Grateful for your help!
-Rob

0 Karma

sloshburch
Splunk Employee
Splunk Employee

For LDAP troubleshooting, did you see this https://docs.splunk.com/Documentation/Splunk/latest/Security/TroubleshootSplunkSSO ? If you need more granular help, I'd suggest another post on answers where we can dig into it further (since this one is already answered and mostly covers a separate question).

0 Karma

robgarner
Path Finder

Good idea. Will check out your link and see where it takes me. Many thanks for all your help ! 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...