Determine which ldap groups are mapped to roles within Splunk

[samuelrey]

We are using ldap for authenticating groups to Splunk. Hundreds of groups listed on the ldap group page. How can I determine which groups are mapped to a role?

[sjaworski]

Hi Samuelrey,

In Splunk 5.1.x
Navigate to Manager/Access Controls/Authentication method and click on "Configure Splunk to use LDAP and map groups"
Then select the "Map Groups" actions for your configured LDAP strategy.

The next view should give you the listing.

In Splunk 6.1.X and 6.2
Navigate to Settings/Access Controls/Authentication method and click on "Configure Splunk to use LDAP and map groups"
Then select the "Map Groups" actions for your configured LDAP strategy.

The next view should give you the listing.

[cpetterborg · Accepted solution]

Settings -> Access Controls -> Authentication Method -> Configure Splunk to use LDAP and map groups -> Map Groups (under Actions for your LDAP configuration)

The Roles column will show if there is a role mapped to the LDAP group.

Select the LDAP group and you can select the roles that are applied to the group.

[cmeo]

I'm deploying in a large enterprise which has hundreds of groups, of which I'm interested in maybe half a dozen. So this method isn't terribly convenient.

Can we please have a filter to show just the currently mapped groups and roles, or some sort of report that does this?

[samuelrey]

Thanks cpetterborg - That helped. I ordered by Role to save me going through all the pages. This gave the groups that are mapped right at the top of the first page.