topic Re: Does Splunk not support LDAP group inheritance? in Security

Does Splunk not support LDAP group inheritance?

Glenn — Fri, 02 Jul 2010 00:00:11 GMT

The way LDAP and Active Directory group membership usually works is through inheritance - groups can be members of other groups, and these subgroups' members are then effectively members of the higher level group. Its tree structure and inheritance are one of the benefits of using LDAP.

I have just created two AD groups for Splunk, one with individual staff records as members, and the other with sub groups as members (in this case, our department/team groups that we use for access across all other apps). The latter is better, because it means that each time someone leaves or joins the team, the Splunk group does not have to be changed. It will just inherit the changes from the team groups.

However, Splunk does not seem to understand the inheritance - members of the first group are the only ones who are allowed to access the app that has been secured to these two groups. The others get the message "App "ig_pci" does not support UI access. See its app.conf for more information".

Does Splunk not support LDAP group inheritance?

Re: Does Splunk not support LDAP group inheritance?

the_wolverine — Fri, 02 Jul 2010 05:46:30 GMT

Correct, Splunk does not support nested groups currently. Splunk users will need to be a direct member of the LDAP group mapped to Splunk role.

Re: Does Splunk not support LDAP group inheritance?

Glenn — Fri, 02 Jul 2010 13:08:35 GMT

Thanks. Do you think it is worth raising an enhancement request for it, or do you know if it already planned? It would make user management so much better if people could use their existing automatically managed team groups, rather than double handling.

Re: Does Splunk not support LDAP group inheritance?

the_wolverine — Fri, 02 Jul 2010 13:18:40 GMT

Yes, it is always worth filing an enhancement request for features that you would like to see in the product.

Re: Does Splunk not support LDAP group inheritance?

Glenn — Tue, 11 Oct 2011 12:59:58 GMT

I have had an enhancement request (45531) in for this functionality since Jul 8, 2010 7:08 AM (yes that's about 16 months).

It wastes a couple of hours of time for a few people in my organisation each week, due to them having to assign individual members (new starters) to the groups, rather than them automatically being included for appropriate access via their team's role group. Over the course of the last 2 years this probably adds up to quite a large operating cost!

Please include this enhancement soon. How can we get its priority raised?

Re: Does Splunk not support LDAP group inheritance?

ithangasamy_spl — Tue, 11 Oct 2011 17:55:31 GMT

This feature is available in the forthcoming Splunk Release, you can request for a beta evaluation from the PMs now.

Re: Does Splunk not support LDAP group inheritance?

Glenn — Tue, 11 Oct 2011 20:19:40 GMT

Sweet, thanks for the update. That would be 4.2.4?

Re: Does Splunk not support LDAP group inheritance?

ithangasamy_spl — Tue, 11 Oct 2011 20:37:26 GMT

it would be 4.3