Security

Determine which ldap groups are mapped to roles within Splunk

samuelrey
New Member

We are using ldap for authenticating groups to Splunk. Hundreds of groups listed on the ldap group page. How can I determine which groups are mapped to a role?

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Settings -> Access Controls -> Authentication Method -> Configure Splunk to use LDAP and map groups -> Map Groups (under Actions for your LDAP configuration)

The Roles column will show if there is a role mapped to the LDAP group.

Select the LDAP group and you can select the roles that are applied to the group.

View solution in original post

sjaworski
Communicator

Hi Samuelrey,

In Splunk 5.1.x
Navigate to Manager/Access Controls/Authentication method and click on "Configure Splunk to use LDAP and map groups"
Then select the "Map Groups" actions for your configured LDAP strategy.

The next view should give you the listing.

In Splunk 6.1.X and 6.2
Navigate to Settings/Access Controls/Authentication method and click on "Configure Splunk to use LDAP and map groups"
Then select the "Map Groups" actions for your configured LDAP strategy.

The next view should give you the listing.

cpetterborg
SplunkTrust
SplunkTrust

Settings -> Access Controls -> Authentication Method -> Configure Splunk to use LDAP and map groups -> Map Groups (under Actions for your LDAP configuration)

The Roles column will show if there is a role mapped to the LDAP group.

Select the LDAP group and you can select the roles that are applied to the group.

cmeo
Contributor

I'm deploying in a large enterprise which has hundreds of groups, of which I'm interested in maybe half a dozen. So this method isn't terribly convenient.

Can we please have a filter to show just the currently mapped groups and roles, or some sort of report that does this?

0 Karma

samuelrey
New Member

Thanks cpetterborg - That helped. I ordered by Role to save me going through all the pages. This gave the groups that are mapped right at the top of the first page.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...