All Apps and Add-ons

sa-ldapsearch: unable to use partial wildcard in LDAP queries

Path Finder


We upgraded SA-Ldapsearch from 2.1.4 to 2.2.0 and since the upgrade we are unable to do some LDAP queries using "partial" wildcards.


|ldapsearch limit=1 search="(sAMAccountName=Username)" 
|ldapsearch limit=1 search="(sAMAccountName=*)" 

Not working:

|ldapsearch limit=1 search="(sAMAccountName=User*)" 

(Note the * after part of the username)

It throws the following error:

External search command 'ldapsearch' returned error code 1. Script output = "error_message=AttributeError at "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\", line 482 : Initial instance has no attribute 'hasValue' " 

Extract from the logs:

2019-02-20 13:40:41,490, Level=ERROR, Pid=8136,, Line=969, AttributeError at "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\", line 482 : Initial instance has no attribute 'hasValue'  Traceback:  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\", line 593, in _process_protocol_v1  self._execute(ifile, None)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\", line 196, in _execute  self._record_writer.write_records(self.generate())  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\", line 519, in write_records  for record in records:  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\", line 105, in generate  for entry in entry_generator:  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\extend\standard\", line 64, in paged_search_generator  None if cookie is True else cookie)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\core\", line 779, in search  response = self.post_send_search(self.send('searchRequest', request, controls))  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\strategy\", line 303, in send  self.connection.request = BaseStrategy.decode_request(message_type, request, controls)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\strategy\", line 635, in decode_request  result = search_request_to_dict(component)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\", line 520, in search_request_to_dict  'filter': filter_to_string(request['filter']),  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\", line 482, in filter_to_string  if substring[component] is not None and substring[component].hasValue():

It was working fine with the 2.1.x version of the App.

I opened a case with support (1287612) and will update on results.



Any news on this? We have the same problem and still no new version. I wont change anything in the code. Whats about a fixed app version, splunk?,

Path Finder

Confirmed workaround is to revert the old part of the problematic function in

alt text
alt text