All Apps and Add-ons

Splunk Support for Active Directory: Why am I getting "KeyError: u'attributes' " using ldapsearch command?

jean_tomaz
Explorer

Hi,

I have a problem using ldapsearch command. See the example below:

| ldapsearch domain="mydomain.com" scope=sub search="(objectClass=*)" attrs="cn"

The returned error is this it.

External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/etc/apps/SA-ldapsearch/bin/ldapsearch.py"", line 100 : u'attributes'" "

Can anyone help? Please.

1 Solution

thomasandersen
Engager

Hi

Add basedn to your search.
|ldapsearch domain="default" basedn="ou=,dc=mydomain,dc=com"

View solution in original post

thomasandersen
Engager

Hi

Add basedn to your search.
|ldapsearch domain="default" basedn="ou=,dc=mydomain,dc=com"

View solution in original post

kevin5even
Explorer

In the answer above, can someone comment on why the scope=sub searches with basedn="dc=mydomain,dc=com" do NOT work (with the error in the original post), while the same scope=sub searches do work when the basedn includes an OU (i.e. basedn="ou=example,dc=mydomain,dc=com").

Shouldn't the fact that scope=sub allow the first search to work?

Also, for note, the search does work on the older version of this app and other ldap tools...

ahall_splunk
Splunk Employee
Splunk Employee

It should work. The attribute error indicates that there is an attribute being asked for that isn't valid or you don't have permission to read. We're going to be releasing v2.0.1 shortly and this problem will be fixed at that point. Until then, I recommend downgrading to v1.1.13.

0 Karma

jean_tomaz
Explorer

Hi, Thomas Andersen

Thanks for your help.

I'm grateful.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!