topic Re: Specifying multiple LDAP static group filters in Security

Specifying multiple LDAP static group filters

aaronkorn — Mon, 25 Mar 2013 17:04:41 GMT

Is there a way to specify multiple group search filters for multiple groups? Currently we have this (sAMAccountName = ISD TSS Management) but is there a way to specify additional groups in this filter?

Re: Specifying multiple LDAP static group filters

yungm — Mon, 25 Mar 2013 17:44:42 GMT

We specify multiple AD groups in "Group base DN" field under "Group settings" as 'cn=admingrp,ou=...;cn=usergrp,ou=...'. We do not use "Static group search filter.

The groups are then mapped to each local Splunk role for access control.

The "User base filter" is defined as follow:

(&(objectCategory=Person)(sAMAccountName=*))

Re: Specifying multiple LDAP static group filters

dfronck — Mon, 23 Sep 2013 18:36:01 GMT

LDAP "Group base DN"

OU=Corporate,OU=Groups,DC=OUR,DC=COMPANY,DC=COM

"Static group search filter"

(|(CN=Splunk*)(CN=UNIX*)(CN=WINTEL*))

This pulls all the groups starting with Splunk, UNIX and WINTEL.

You could also do something with wildcards.

(|(CN=Splunk*)(CN=*UNIX*)(CN=*WINTEL*))

This pulls all the groups starting with Splunk, and contains UNIX or WINTEL.

Re: Specifying multiple LDAP static group filters

3johnson — Wed, 25 Jan 2017 16:14:53 GMT

(CN=Splunk*)
This syntax worked fine for us to only display groups for mapping that begin with "Splunk"; but, the BIG difference is the groups have to be populated with users or Splunk produces a cryptic error stating that it can't find any groups with the search criteria. The better error would be that I can't find any groups WITH USERS IN IT with the search criteria. Limiting the DN of the group produces the same error if the group is empty.

It seems like a Splunk proces logic flaw. On every system for 25years the process is: Create Groups > Map Roles > Populate groups with users and test.
,(CN=Splunk*)
This syntax worked fine for us to only display groups for mapping that begin with "Splunk"; but, the BIG difference is the groups have to be populated with users or Splunk produces a cryptic error stating that it can't find any groups with the search criteria. The better error would be that I can't find any groups WITH USERS IN IT with the search criteria. Limiting the DN of the group produces the same error if the group is empty.

It seems like a Splunk proces logic flaw. On every system for 25years the process is: Create Groups > Map Roles > Populate groups with users and test.