Script error during SA-ldapsearch test connection

[thebarryk]

I need help getting started with SA-ldapsearch because there are no results returned during the test connection phase of SA-ldapsearch configuration. Test connection starts the search:

| ldapsearch domain="default" scope=base search="(objectClass=*)" attrs="distinguishedName"

The events showing the error in the SA-ldapsearch.log file are:

2014-10-25 08:04:55,375, Level=ERROR, Pid=7872, File=search_command.py, Line=342, Traceback (most recent call last):
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\search_command.py", line 316, in process
    self._execute(operation, reader, writer)
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\generating_command.py", line 79, in _execute
    for record in operation():
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\ldapsearch.py", line 79, in generate
    configuration = app.Configuration(self)
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 42, in __init__
    self._read_configuration()
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 149, in _read_configuration
    settings = self._read_default_configuration()
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 177, in _read_default_configuration
    settings = {entry[u'title']: entry[u'content'][u'$text'] for entry in entries} if entries else {}
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 177, in <dictcomp>
    settings = {entry[u'title']: entry[u'content'][u'$text'] for entry in entries} if entries else {}
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\data.py", line 245, in __getitem__
    raise KeyError("No key or prefix: %s" % key)

KeyError: u'No key or prefix: $text.'

The scrubbed (so many subdomains) ldap.conf file is:

[default]
alternatedomain = MAINDOMAIN
basedn = dc=maindomain,dc=dc1,dc=dc2,dc=dc3,dc=dc4,dc=us
binddn = cn=doctor.whom,OU=OU1,OU=OU2,OU=OU3,dc=maindomain,dc=dc1,dc=dc2,dc=dc3,dc=dc4,dc=us
password = 
port = 389
server = 10.11.12.13
ssl = 0

The password was entered in the configuration form in Base-64 and appears to have been moved to app.conf. I'm using a trial version on Splunk Enterprise Version 6.1.3 provided by Splunk sales on a Windows 7 PC. SA-ldapsearch app was downloaded 10/15/2014. I have not been able to find the version.

Thanks,
Barry

[itghelp]

Delete the "SA-ldapsearch" directory from "$SPLUNK_HOME/etc/apps" and restart Splunk.

Go to Add-Ons, reinstall the SA-ldapsearch addon, restart Splunk.

Reconfigure the Addon using its configuration page and it should work.

[jhernandez_splu]

Thanks this worked! Do you know why the new SA-ldapsearch exhibits this behavior? Just curious.

[itghelp]

My best guess is that the upgrade (I'm assuming you upgraded from a previous version too) process failed to properly clean the environment for the new version. Glad it's working for you!

[jhernandez_splu]

Gotcha. I was not the person whom installed it on the system, so I am not sure if it was an upgrade. Although I did notice the UI config changes were properly reflected on the local/ldap.conf file. Strange.

[musskopf]

Same problems with the new version (v 2.0) over here... nothing works 😞

[itghelp]

** EDIT: I uninstalled and reinstalled the addon and it fixed the problem.

I'm also running into this issue on with an indexer running Splunk 6.2.0 on 64-bit Ubuntu with SA-ldapsearch v 2.0.1. I get the exact same error text.

Here's my scrubbed config:
[default]
server = 10.0.0.1
port = 3268
basedn = DC=ad,DC=department,DC=school,DC=edu
binddn = CN=splunk_user,OU=Admin,OU=ABCDE,DC=ad,DC=department,DC=school,DC=edu
password =
alternatedomain = AD
ssl = 0

There is a Base-64 password in app.conf.