Deployment Architecture

LDAP objectclass: nisNetgroup

ralphw_SAIC
Path Finder

We are using Splunk 6.2.3 in a linux environment and I am trying to get LDAP working before our roll out to users. Unfortunately the groups we are using are of objectclass: nisNetgroup which the format of the tuple is (hostname, username, domain name). We are only using the username (,jdoe,) for server authentication.

Splunk LDAP is failing to recognize the username in this tuple. Is anyone using nisNetgroup for authentication or know of a way to filter out just the username in Splunk?

Tags (3)
0 Karma
1 Solution

mdonnelly_splun
Splunk Employee
Splunk Employee

Splunk cannot work against ‘nisNetGroupTriple’. That type of group is specifically intended to control who can log into a set of hosts, and as you note the format includes hostname and domain name.

The way authentication works, the user's login is validated first - then a selected value from the user's own entry is extracted from that entry. This value is used to identify which other groups contain that user. You can read more about this approach here: http://ldapman.org/authentication

Unfortunately, there is no value in the user's entry that would match the format used in the nisNetGroupTriple.

We do support the other formats from the NIS / LDAP RFCs:
objectClass=rfc822MailGroup
objectClass=posixGroup

... Or any other group whose members are stored either as a login name, email address, or full DN.

View solution in original post

0 Karma

mdonnelly_splun
Splunk Employee
Splunk Employee

Splunk cannot work against ‘nisNetGroupTriple’. That type of group is specifically intended to control who can log into a set of hosts, and as you note the format includes hostname and domain name.

The way authentication works, the user's login is validated first - then a selected value from the user's own entry is extracted from that entry. This value is used to identify which other groups contain that user. You can read more about this approach here: http://ldapman.org/authentication

Unfortunately, there is no value in the user's entry that would match the format used in the nisNetGroupTriple.

We do support the other formats from the NIS / LDAP RFCs:
objectClass=rfc822MailGroup
objectClass=posixGroup

... Or any other group whose members are stored either as a login name, email address, or full DN.

0 Karma

ralphw_SAIC
Path Finder

Or it might be better to ask, what objectclass to use for LDAP Auth?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...