Security

Unable to view LDAP group under Access controls

vsidharda
Engager

Hey Splunkers,

I have requested AD team to create a new LDAP group. They have created a new one and added users to that group.

But, I am unable to view that new AD group in Splunk UI under Access controls » Authentication method » LDAP strategies » LDAP Groups

Will Splunk show all the active LDAP groups in organization?.

How will Splunk filter and show the LDAP groups in the UI? Do we have to do any setting?

Thanks in advance !!

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Assuming your AD team does not also manage Splunk, you will need a service account with credentials (Bind DN / Bind DN Password) in order to create a new LDAP binding, and then map the group itself.

alt text

----
An upvote would be appreciated and Accept Solution if it helps!

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

As far as I remember correctly it'll fetch 1000 results only, I'll suggest to use Static group search filter aka. groupBaseFilter in authorize.conf to filter out required group(s) or you can use wildcard as well like your all Splunk LDAP group starts with App-Splunk-BLABLA then you can use groupBaseFilter = (cn=APP-SPLUNK-*) in authorize.conf for LDAP strategy.

0 Karma

vsidharda
Engager

Yes, that filtering worked. Thanks !!

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

I have converted my comment to answer so that you can accept it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...