All Apps and Add-ons

Why does Splunk Support for Active Directory 2.1.2 still throw admin_all_capability permissions errors when non-admin users run searches?

lohitkidu
Path Finder

Hi All ,

I have installed Splunk Support for Active Directory 2.1.2 in our search head cluster and search peers. Non-admin users are not able to search and getting following error:

File=configuration.py, Line=508, Storage password "SA-ldapsearch:default:" access denied: HTTP 403 Forbidden --
 In handler 'passwords': You (user=test) do not have permission to perform this operation (requires capability: admin_all_objects).

Though it is a bad practice, but the password in ldap.conf is in clear text. I thought this issue would have resolved in 2.1.2?

Any ideas ?

srinathd
Contributor

Make sure that the user that you log into Splunk Enterprise as has the admin_all_objects capability. This capability must be present because the configuration page saves passwords as storage passwords, and only this capability allows users to read storage passwords.

If you cannot grant the admin_all_objects capability, as a workaround, you can use a clear-text password and obfuscate that password with base-64 encoding(password prefixed with {64} will encode). In this case, however, you can not use the configuration page to save the password nor can you test the connection. This is because the configuration page moves any clear-text passwords to storage passwords when you save the configuration.

You must edit ldap.conf with a text editor and save the password(s) that way, and then use the ldaptestconnection command to test the configuration.

0 Karma

lohitkidu
Path Finder

Also I see different passwords in ldap.conf under default stanza(which i am using) and in passwords.conf under [credential:SA-ldapsearch:default:] stanza.

0 Karma

lohitkidu
Path Finder

Though I have used test connection via the configuration page. Would even that move my clear-text password to storage password. I can see my clear text password in ldap.conf for now ?

0 Karma

lohitkidu
Path Finder

I already have this fix couple of versions back. In my environment, non-admin users are getting results for ldapsearch command with error
External search command 'ldapsearch' returned error code 1. Script output = " ERROR "000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1" "

While for ldapfilter command no results are returned.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...