topic Re: Why is our Splunk LDAP / Active Directory authentication not showing security groups? in Security

Why is our Splunk LDAP / Active Directory authentication not showing security groups?

dpratt9 — Thu, 03 Sep 2015 15:49:32 GMT

We've inherited a Splunk deployment that is authenticating against Active Directory with LDAP.

We can see users and distribution groups from AD, but not security groups.

Can you help point me in the right direction for why we cannot see security groups for managing access to our Splunk deployment?

[DOMAIN - ActiveDirectory]
SSLEnabled = 0
anonymous_referrals = 1
bindDN = <redacted>
bindDNpassword = 
charset = utf8
dynamicMemberAttribute = member
emailAttribute = mail
groupBaseDN = <redacted>
groupBaseFilter = (objectclass=group)
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = myserver.mydomain
nestedGroups = 1
network_timeout = 20
port = 666
realNameAttribute = displayname
sizelimit = 980
timelimit = 15
userBaseDN = <redacted>
userNameAttribute = samaccountname

Re: Why is our Splunk LDAP / Active Directory authentication not showing security groups?

teunlaan — Fri, 04 Sep 2015 07:42:39 GMT

Keep in mind Splunk only displays groups when the are Users in that group.

Re: Why is our Splunk LDAP / Active Directory authentication not showing security groups?

dpratt9 — Fri, 04 Sep 2015 14:56:31 GMT

ahhh.... good point. Currently, the security group is populated with six users. We don't have a userBaseFilter set, is there anything else that could be masking the users on the Splunk side and preventing the group from being visible?

Re: Why is our Splunk LDAP / Active Directory authentication not showing security groups?

doksu — Sun, 06 Sep 2015 22:48:58 GMT

Turning on debug level logging may help:

Setting > Server settings > Server logging > ScopedLDAPConnection > DEBUG
Setting > Server settings > Server logging > AuthenticationManagerLDAP > DEBUG

We had a similar issue and discovered that the LDAP query Splunk runs always has the filter: (displayname=*), so if an object doesn't have its display name populated, Splunk won't "see" the object.

Re: Why is our Splunk LDAP / Active Directory authentication not showing security groups?

dpratt9 — Tue, 08 Sep 2015 20:58:34 GMT

So far we've been unable to see a (displayname=*) filter present in our LDAP queries when debugging. However, we did notice that our LDAP query is only displaying 2,000 (of 2,613) groups even after increasing our LDAP query limits on the Splunk side.

Continuing to dig...