All Apps and Add-ons

sa-ldapsearch: unable to use partial wildcard in LDAP queries

letienne
Path Finder

Hello,

We upgraded SA-Ldapsearch from 2.1.4 to 2.2.0 and since the upgrade we are unable to do some LDAP queries using "partial" wildcards.

Working:

|ldapsearch limit=1 search="(sAMAccountName=Username)" 
|ldapsearch limit=1 search="(sAMAccountName=*)" 

Not working:

|ldapsearch limit=1 search="(sAMAccountName=User*)" 

(Note the * after part of the username)

It throws the following error:

External search command 'ldapsearch' returned error code 1. Script output = "error_message=AttributeError at "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\search.py", line 482 : Initial instance has no attribute 'hasValue' " 

Extract from the logs:

2019-02-20 13:40:41,490, Level=ERROR, Pid=8136, File=search_command.py, Line=969, AttributeError at "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\search.py", line 482 : Initial instance has no attribute 'hasValue'  Traceback:  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\search_command.py", line 593, in _process_protocol_v1  self._execute(ifile, None)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\generating_command.py", line 196, in _execute  self._record_writer.write_records(self.generate())  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\internals.py", line 519, in write_records  for record in records:  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\ldapsearch.py", line 105, in generate  for entry in entry_generator:  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\extend\standard\PagedSearch.py", line 64, in paged_search_generator  None if cookie is True else cookie)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\core\connection.py", line 779, in search  response = self.post_send_search(self.send('searchRequest', request, controls))  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\strategy\base.py", line 303, in send  self.connection.request = BaseStrategy.decode_request(message_type, request, controls)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\strategy\base.py", line 635, in decode_request  result = search_request_to_dict(component)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\search.py", line 520, in search_request_to_dict  'filter': filter_to_string(request['filter']),  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\search.py", line 482, in filter_to_string  if substring[component] is not None and substring[component].hasValue():

It was working fine with the 2.1.x version of the App.

I opened a case with support (1287612) and will update on results.

Regards,

dschroeter
Explorer

Any news on this? We have the same problem and still no new version. I wont change anything in the code. Whats about a fixed app version, splunk?,

letienne
Path Finder

Confirmed workaround is to revert the old part of the problematic function in search.py:

alt text
alt text

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...