We use Splunk's storage passwords endpoint to read/write passwords. This endpoint cannot be accessed by users without admin_all_objects capability. You might wish to create a new role for this. You might, for example, create an "SA-ldapsearch user" role that inherits from user and adds the admin_all_objects capability. The admin_all_objects capability grants users significant access rights: A role with this capability has access to objects in the system (user objects, search jobs, etc.). This bypasses any ACL restrictions (similar to root access in a *nix environment). We check this capability when accessing manager pages and objects. See the authorize.conf spec for additional information. We are considering developing an alternative to the storage password endpoint for securely storing credentials in a future release of the Splunk Support Add-on for Active Directory; one that would not require admin_all_objects capability. Please stay tuned. ... View more

Thanks for reporting this issue. It is a bug and I have a fix in hand. We will include it in the next Python SDK release. Here's what you need to do to make the change yourself. Get the current Python SDK: version 1.2.1 At splunklib/binding.py, line 248 change: return request_fun() to return request_fun(self, *args, **kwargs) Feel free to e-mail me directly, if you'd like additional help resolving this issue. Thanks for using Splunk and the Splunk SDK Best, David Noble dnoble@splunk.com ... View more