All Apps and Add-ons

SA-ldapsearch 2.0 fails to query global catalog

rvasaly_splunk
Splunk Employee
Splunk Employee

Configured LDAP BIND service account to log on to an AD domain controller acting as a global catalog for multiple domains. Queries to the primary domain on the controller work, but queries to any other domain within the global catalog return no results and do not throw an error. Default config is using port 3268 and a null Base DN, with the query itself defining the basedn:

works:

| ldapsearch domain="default" scope=base basedn="dc=primary, dc=domain" search="(objectclass=*)" attrs="*"

fails:

| ldapsearch domain="default" scope=base basedn="dc=other, dc=altdomain" search="(objectclass=*)" attrs="*"

(tried many variations of scope and search strings)

Note that all other AD/LDAP tools in use at the customer site can bind to this same domain controller and browse all the other domains in the global catalog.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Have you read through the troubleshooting SA-Ldapsearch guid? http://docs.splunk.com/Documentation/SA-LdapSearch/latest/User/UseSA-ldapsearchtotroubleshootproblem...

Maybe specifically :
'Default' stanza
To support context lookups in the "ldapfetch" command, you will also need a "default" stanza that lists a forest-level Global Catalog server by its IP address. In this case, you must specify the port to the Global Catalog. Following is an example:

[default]
server = 172.20.1.2
port = 3268

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...