All Apps and Add-ons

Script error during SA-ldapsearch test connection

thebarryk
Engager

I need help getting started with SA-ldapsearch because there are no results returned during the test connection phase of SA-ldapsearch configuration. Test connection starts the search:

| ldapsearch domain="default" scope=base search="(objectClass=*)" attrs="distinguishedName"

The events showing the error in the SA-ldapsearch.log file are:

2014-10-25 08:04:55,375, Level=ERROR, Pid=7872, File=search_command.py, Line=342, Traceback (most recent call last):
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\search_command.py", line 316, in process
    self._execute(operation, reader, writer)
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\generating_command.py", line 79, in _execute
    for record in operation():
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\ldapsearch.py", line 79, in generate
    configuration = app.Configuration(self)
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 42, in __init__
    self._read_configuration()
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 149, in _read_configuration
    settings = self._read_default_configuration()
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 177, in _read_default_configuration
    settings = {entry[u'title']: entry[u'content'][u'$text'] for entry in entries} if entries else {}
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\configuration.py", line 177, in <dictcomp>
    settings = {entry[u'title']: entry[u'content'][u'$text'] for entry in entries} if entries else {}
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\data.py", line 245, in __getitem__
    raise KeyError("No key or prefix: %s" % key)

KeyError: u'No key or prefix: $text.'

The scrubbed (so many subdomains) ldap.conf file is:

[default]
alternatedomain = MAINDOMAIN
basedn = dc=maindomain,dc=dc1,dc=dc2,dc=dc3,dc=dc4,dc=us
binddn = cn=doctor.whom,OU=OU1,OU=OU2,OU=OU3,dc=maindomain,dc=dc1,dc=dc2,dc=dc3,dc=dc4,dc=us
password = 
port = 389
server = 10.11.12.13
ssl = 0

The password was entered in the configuration form in Base-64 and appears to have been moved to app.conf. I'm using a trial version on Splunk Enterprise Version 6.1.3 provided by Splunk sales on a Windows 7 PC. SA-ldapsearch app was downloaded 10/15/2014. I have not been able to find the version.

Thanks,
Barry

itghelp
Path Finder

Delete the "SA-ldapsearch" directory from "$SPLUNK_HOME/etc/apps" and restart Splunk.

Go to Add-Ons, reinstall the SA-ldapsearch addon, restart Splunk.

Reconfigure the Addon using its configuration page and it should work.

jhernandez_splu
Splunk Employee
Splunk Employee

Thanks this worked! Do you know why the new SA-ldapsearch exhibits this behavior? Just curious.

0 Karma

itghelp
Path Finder

My best guess is that the upgrade (I'm assuming you upgraded from a previous version too) process failed to properly clean the environment for the new version. Glad it's working for you!

0 Karma

jhernandez_splu
Splunk Employee
Splunk Employee

Gotcha. I was not the person whom installed it on the system, so I am not sure if it was an upgrade. Although I did notice the UI config changes were properly reflected on the local/ldap.conf file. Strange.

0 Karma

musskopf
Builder

Same problems with the new version (v 2.0) over here... nothing works 😞

0 Karma

itghelp
Path Finder

** EDIT: I uninstalled and reinstalled the addon and it fixed the problem.

I'm also running into this issue on with an indexer running Splunk 6.2.0 on 64-bit Ubuntu with SA-ldapsearch v 2.0.1. I get the exact same error text.

Here's my scrubbed config:
[default]
server = 10.0.0.1
port = 3268
basedn = DC=ad,DC=department,DC=school,DC=edu
binddn = CN=splunk_user,OU=Admin,OU=ABCDE,DC=ad,DC=department,DC=school,DC=edu
password =
alternatedomain = AD
ssl = 0

There is a Base-64 password in app.conf.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...