Splunk Support for Active Directory: Why am I getting "KeyError: u'attributes' " using ldapsearch command?

[jean_tomaz]

Hi,

I have a problem using ldapsearch command. See the example below:

| ldapsearch domain="mydomain.com" scope=sub search="(objectClass=*)" attrs="cn"

The returned error is this it.

External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/etc/apps/SA-ldapsearch/bin/ldapsearch.py"", line 100 : u'attributes'" "

Can anyone help? Please.

[thomasandersen · Accepted solution]

Hi

Add basedn to your search.
|ldapsearch domain="default" basedn="ou=,dc=mydomain,dc=com"

[kevin5even]

In the answer above, can someone comment on why the scope=sub searches with basedn="dc=mydomain,dc=com" do NOT work (with the error in the original post), while the same scope=sub searches do work when the basedn includes an OU (i.e. basedn="ou=example,dc=mydomain,dc=com").

Shouldn't the fact that scope=sub allow the first search to work?

Also, for note, the search does work on the older version of this app and other ldap tools...

[ahall_splunk]

It should work. The attribute error indicates that there is an attribute being asked for that isn't valid or you don't have permission to read. We're going to be releasing v2.0.1 shortly and this problem will be fixed at that point. Until then, I recommend downgrading to v1.1.13.

[jean_tomaz]

Hi, Thomas Andersen

Thanks for your help.

I'm grateful.