Deployment Architecture

LDAP objectclass: nisNetgroup

ralphw_SAIC
Path Finder

We are using Splunk 6.2.3 in a linux environment and I am trying to get LDAP working before our roll out to users. Unfortunately the groups we are using are of objectclass: nisNetgroup which the format of the tuple is (hostname, username, domain name). We are only using the username (,jdoe,) for server authentication.

Splunk LDAP is failing to recognize the username in this tuple. Is anyone using nisNetgroup for authentication or know of a way to filter out just the username in Splunk?

Tags (3)
0 Karma
1 Solution

mdonnelly_splun
Splunk Employee
Splunk Employee

Splunk cannot work against ‘nisNetGroupTriple’. That type of group is specifically intended to control who can log into a set of hosts, and as you note the format includes hostname and domain name.

The way authentication works, the user's login is validated first - then a selected value from the user's own entry is extracted from that entry. This value is used to identify which other groups contain that user. You can read more about this approach here: http://ldapman.org/authentication

Unfortunately, there is no value in the user's entry that would match the format used in the nisNetGroupTriple.

We do support the other formats from the NIS / LDAP RFCs:
objectClass=rfc822MailGroup
objectClass=posixGroup

... Or any other group whose members are stored either as a login name, email address, or full DN.

View solution in original post

0 Karma

mdonnelly_splun
Splunk Employee
Splunk Employee

Splunk cannot work against ‘nisNetGroupTriple’. That type of group is specifically intended to control who can log into a set of hosts, and as you note the format includes hostname and domain name.

The way authentication works, the user's login is validated first - then a selected value from the user's own entry is extracted from that entry. This value is used to identify which other groups contain that user. You can read more about this approach here: http://ldapman.org/authentication

Unfortunately, there is no value in the user's entry that would match the format used in the nisNetGroupTriple.

We do support the other formats from the NIS / LDAP RFCs:
objectClass=rfc822MailGroup
objectClass=posixGroup

... Or any other group whose members are stored either as a login name, email address, or full DN.

0 Karma

ralphw_SAIC
Path Finder

Or it might be better to ask, what objectclass to use for LDAP Auth?

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...