Security

How do I get LDAP values from Active Directory?

matt
Splunk Employee
Splunk Employee

I need to figure out what LDAP values I should be using to make auth work.

2 Solutions

matt
Splunk Employee
Splunk Employee

If you are comfortable with the command line you can run the command ldifede. The ldifde command is the windows equivalent of ldapsearch and should allow you to get an ldif entry for yourself and a group. With those two entries we should be able to come up with authentication.conf that will allow Splunk to authenticate users.

If you are more comfortable with a GUI The Sysinternals team offers a nice utility called Active Directory Explorer. This gives you tree view of your Active Directory/LDAP structure similar to Windows Explorer.

Both "LDP" and "ADSIEDIT.MSC" are built in utilities that allow you to have a GUI view of Active Directory. Run them from "Start--> Run" in Windows on your AD Server

The values that you will need to map are:

BindDN: This will be the full Distinguised Name of the user that Splunk is going to connect to the AD server as

UserBaseDN: Look at the Distinguished name for the user that you got from ldifde and take everything after cn=foo

GroupBaseDN: Look at the Distinguished name for the group that you got from ldifde and take everything after cn=foo

Real name attribute: Look for the key that is associated with the full name of the user (likely displayName)

Group name attribute: Look for the key that is associated with the full name of the group (likely cn)

Group member attribute: Its usually memberOf or member, depending on whether the memberships are listed in the group entry or the user entry

You may also want to check out this video from the Splunk Ninja

View solution in original post

benstraw
Splunk Employee
Splunk Employee

There are good examples for using ldif and ldapsearch on the splunk documentation. http://docs.splunk.com/Documentation/Splunk/5.0/Security/SetupuserauthenticationwithLDAP

View solution in original post

the_wolverine
Champion

Another great (freeware) LDAP browser is Apache Directory Studio. You can download builds for OSX, Linux and Windows.

benstraw
Splunk Employee
Splunk Employee

There are good examples for using ldif and ldapsearch on the splunk documentation. http://docs.splunk.com/Documentation/Splunk/5.0/Security/SetupuserauthenticationwithLDAP

matt
Splunk Employee
Splunk Employee

If you are comfortable with the command line you can run the command ldifede. The ldifde command is the windows equivalent of ldapsearch and should allow you to get an ldif entry for yourself and a group. With those two entries we should be able to come up with authentication.conf that will allow Splunk to authenticate users.

If you are more comfortable with a GUI The Sysinternals team offers a nice utility called Active Directory Explorer. This gives you tree view of your Active Directory/LDAP structure similar to Windows Explorer.

Both "LDP" and "ADSIEDIT.MSC" are built in utilities that allow you to have a GUI view of Active Directory. Run them from "Start--> Run" in Windows on your AD Server

The values that you will need to map are:

BindDN: This will be the full Distinguised Name of the user that Splunk is going to connect to the AD server as

UserBaseDN: Look at the Distinguished name for the user that you got from ldifde and take everything after cn=foo

GroupBaseDN: Look at the Distinguished name for the group that you got from ldifde and take everything after cn=foo

Real name attribute: Look for the key that is associated with the full name of the user (likely displayName)

Group name attribute: Look for the key that is associated with the full name of the group (likely cn)

Group member attribute: Its usually memberOf or member, depending on whether the memberships are listed in the group entry or the user entry

You may also want to check out this video from the Splunk Ninja

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...