https://community.splunk.com/t5/Security/Splunk-LDAP-User-and-Group-Filters/m-p/87773#M2916 <P>Can any one expain or point me to the docs of how the LDAP User and Group Filters work ? I have gone through the docs <A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureLDAPwithSplunkWeb">http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureLDAPwithSplunkWeb</A> but I'm still unable to understand it clearly. </P> Tue, 15 Jan 2013 15:04:39 GMT ssankeneni 2013-01-15T15:04:39Z https://community.splunk.com/t5/Security/Splunk-LDAP-User-and-Group-Filters/m-p/87773#M2916 <P>Can any one expain or point me to the docs of how the LDAP User and Group Filters work ? I have gone through the docs <A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureLDAPwithSplunkWeb">http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureLDAPwithSplunkWeb</A> but I'm still unable to understand it clearly. </P> Tue, 15 Jan 2013 15:04:39 GMT https://community.splunk.com/t5/Security/Splunk-LDAP-User-and-Group-Filters/m-p/87773#M2916 ssankeneni 2013-01-15T15:04:39Z https://community.splunk.com/t5/Security/Splunk-LDAP-User-and-Group-Filters/m-p/87774#M2917 <P>Without a filter, the query sent by splunk to LDAP will say 'give me a list of all users'.<BR /><BR /> This could be hundreds of thousands of accounts.</P> <P>If you specify a filter i.e. 'Department=Splunk' </P> <P>Then the query sent by splunk to LDAP will say 'give me a list of users who belong to the Splunk department'.<BR /><BR /> The list of users returned will be much smaller.</P> <P>Same theory for group filters.</P> Tue, 15 Jan 2013 15:44:23 GMT https://community.splunk.com/t5/Security/Splunk-LDAP-User-and-Group-Filters/m-p/87774#M2917 jonuwz 2013-01-15T15:44:23Z https://community.splunk.com/t5/Security/Splunk-LDAP-User-and-Group-Filters/m-p/87775#M2918 <P>Does the group and user filter are related ? If so how ?</P> Tue, 15 Jan 2013 17:48:13 GMT https://community.splunk.com/t5/Security/Splunk-LDAP-User-and-Group-Filters/m-p/87775#M2918 ssankeneni 2013-01-15T17:48:13Z https://community.splunk.com/t5/Security/Splunk-LDAP-User-and-Group-Filters/m-p/87776#M2919 <P>No. One is a query to get a list of all the users, the other is a query to get a list of all the groups.</P> <P>The groups that a user belongs to is pulled from the user attribute 'memberOf' (or whatever the group membership attribute is in your flavour of LDAP)</P> Thu, 17 Jan 2013 15:43:13 GMT https://community.splunk.com/t5/Security/Splunk-LDAP-User-and-Group-Filters/m-p/87776#M2919 jonuwz 2013-01-17T15:43:13Z