topic Re: How can I retrieve a list of LDAP users in my Splunk search? in Splunk Search

How can I retrieve a list of LDAP users in my Splunk search?

jcorkey — Tue, 22 Aug 2017 16:09:37 GMT

I need to create a search that can retrieve a list of privileged group members from my LDAP server so I can then use that list in my search string.
For example, if I wanted to list all users who are or are not privileged group members I could say something like:

 index=* user=* | stats count by user (EXCLUDING ALL OTHER USERS IN THE LIST OF LDAP PRIVILEGED GROUP MEMBERS I RETRIEVED)

I have looked into trying to use a external scripted lookup that will connect to my LDAP and do a query but no luck yet.
I am also seeing some answers that say to use something like this:

| rest /services/authentication/users splunk_server=local | table realname

no idea what exactly that does or what/where /services/authentication/users is.
How can I accomplish this?

Re: How can I retrieve a list of LDAP users in my Splunk search?

vasanthmss — Tue, 22 Aug 2017 16:48:09 GMT

Hi Jcorkey,

To get the list of users in the system use the below search,

| rest /services/authentication/users splunk_server=local | table type, title, roles, realname email *

To get only the LDAP users you have to filter the type, where type=LDAP is LDAP user and type=Splunk is Splunk created user,

| rest /services/authentication/users splunk_server=local | where type="LDAP" | table type, title, roles, realname email *

Hope this helps you !!

Re: How can I retrieve a list of LDAP users in my Splunk search?

jcorkey — Tue, 22 Aug 2017 17:55:29 GMT

Will this work on a linux box??

Re: How can I retrieve a list of LDAP users in my Splunk search?

vasanthmss — Tue, 22 Aug 2017 18:04:24 GMT

it's a splunk search so it doesn't matter windows / linux. Do you have sufficient permission to run the search?

Re: How can I retrieve a list of LDAP users in my Splunk search?

jcorkey — Wed, 23 Aug 2017 12:59:35 GMT

Yea I have permissions. But this doesn't sound like what I need or maybe I just don't fully understand what this is doing. I need to be able to actually connect to my LDAP server and get a list of privileged group members from the LDAP.

Re: How can I retrieve a list of LDAP users in my Splunk search?

vasanthmss — Wed, 23 Aug 2017 17:41:17 GMT

LDAP users which are access to the Splunk will be list down in the rest command.

if you want to query the LDAP, Usually organizations will use the some GUI for LDAP / Active Directory,
OR

you can use the Add-on SA-LDAPSearch .

https://splunkbase.splunk.com/app/1151/
https://docs.splunk.com/Documentation/SA-LdapSearch/2.1.4/User/Theldapsearchcommand

Re: How can I retrieve a list of LDAP users in my Splunk search?

DalJeanis — Wed, 23 Aug 2017 19:21:59 GMT

Is your question with regard to users of the splunk system, or users of your other systems at large?

Re: How can I retrieve a list of LDAP users in my Splunk search?

jcorkey — Thu, 24 Aug 2017 13:13:30 GMT

I would use this but I am using Rhel machines not windows

Re: How can I retrieve a list of LDAP users in my Splunk search?

jcorkey — Thu, 24 Aug 2017 13:14:53 GMT

Im using openldap and SA-LDAPSearch is for active directory

Re: How can I retrieve a list of LDAP users in my Splunk search?

jcorkey — Thu, 24 Aug 2017 13:16:44 GMT

other Rhel systems at large. We are using openLdap and have different Ldap clients which use the Ldap server for authentication.

Re: How can I retrieve a list of LDAP users in my Splunk search?

vasanthmss — Tue, 29 Aug 2017 20:51:48 GMT

have you tried JXplorer? Check this, http://jxplorer.org/

Read this link, there were plenty of tools for LDAP Browser for linux,

http://www.ldapbrowserlinux.com/

Re: How can I retrieve a list of LDAP users in my Splunk search?

joesrepsol — Fri, 27 Apr 2018 17:27:10 GMT

Works great. Thanks so much!

Re: How can I retrieve a list of LDAP users in my Splunk search?

vasanthmss — Fri, 19 Oct 2018 18:28:20 GMT

Glad that works, Accept the answer.