All Apps and Add-ons

Script error during SA-ldapsearch test connection

thebarryk
Engager

I need help getting started with SA-ldapsearch because there are no results returned during the test connection phase of SA-ldapsearch configuration. Test connection starts the search:

| ldapsearch domain="default" scope=base search="(objectClass=*)" attrs="distinguishedName"

The events showing the error in the SA-ldapsearch.log file are:

2014-10-25 08:04:55,375, Level=ERROR, Pid=7872, File=search_command.py, Line=342, Traceback (most recent call last):
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\search_command.py", line 316, in process
    self._execute(operation, reader, writer)
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\generating_command.py", line 79, in _execute
    for record in operation():
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\ldapsearch.py", line 79, in generate
    configuration = app.Configuration(self)
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 42, in __init__
    self._read_configuration()
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 149, in _read_configuration
    settings = self._read_default_configuration()
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 177, in _read_default_configuration
    settings = {entry[u'title']: entry[u'content'][u'$text'] for entry in entries} if entries else {}
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 177, in <dictcomp>
    settings = {entry[u'title']: entry[u'content'][u'$text'] for entry in entries} if entries else {}
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\data.py", line 245, in __getitem__
    raise KeyError("No key or prefix: %s" % key)

KeyError: u'No key or prefix: $text.'

The scrubbed (so many subdomains) ldap.conf file is:

[default]
alternatedomain = MAINDOMAIN
basedn = dc=maindomain,dc=dc1,dc=dc2,dc=dc3,dc=dc4,dc=us
binddn = cn=doctor.whom,OU=OU1,OU=OU2,OU=OU3,dc=maindomain,dc=dc1,dc=dc2,dc=dc3,dc=dc4,dc=us
password = 
port = 389
server = 10.11.12.13
ssl = 0

The password was entered in the configuration form in Base-64 and appears to have been moved to app.conf. I'm using a trial version on Splunk Enterprise Version 6.1.3 provided by Splunk sales on a Windows 7 PC. SA-ldapsearch app was downloaded 10/15/2014. I have not been able to find the version.

Thanks,
Barry

itghelp
Path Finder

Delete the "SA-ldapsearch" directory from "$SPLUNK_HOME/etc/apps" and restart Splunk.

Go to Add-Ons, reinstall the SA-ldapsearch addon, restart Splunk.

Reconfigure the Addon using its configuration page and it should work.

jhernandez_splu
Splunk Employee
Splunk Employee

Thanks this worked! Do you know why the new SA-ldapsearch exhibits this behavior? Just curious.

0 Karma

itghelp
Path Finder

My best guess is that the upgrade (I'm assuming you upgraded from a previous version too) process failed to properly clean the environment for the new version. Glad it's working for you!

0 Karma

jhernandez_splu
Splunk Employee
Splunk Employee

Gotcha. I was not the person whom installed it on the system, so I am not sure if it was an upgrade. Although I did notice the UI config changes were properly reflected on the local/ldap.conf file. Strange.

0 Karma

musskopf
Builder

Same problems with the new version (v 2.0) over here... nothing works 😞

0 Karma

itghelp
Path Finder

** EDIT: I uninstalled and reinstalled the addon and it fixed the problem.

I'm also running into this issue on with an indexer running Splunk 6.2.0 on 64-bit Ubuntu with SA-ldapsearch v 2.0.1. I get the exact same error text.

Here's my scrubbed config:
[default]
server = 10.0.0.1
port = 3268
basedn = DC=ad,DC=department,DC=school,DC=edu
binddn = CN=splunk_user,OU=Admin,OU=ABCDE,DC=ad,DC=department,DC=school,DC=edu
password =
alternatedomain = AD
ssl = 0

There is a Base-64 password in app.conf.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...