Security

Determine which ldap groups are mapped to roles within Splunk

samuelrey
New Member

We are using ldap for authenticating groups to Splunk. Hundreds of groups listed on the ldap group page. How can I determine which groups are mapped to a role?

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Settings -> Access Controls -> Authentication Method -> Configure Splunk to use LDAP and map groups -> Map Groups (under Actions for your LDAP configuration)

The Roles column will show if there is a role mapped to the LDAP group.

Select the LDAP group and you can select the roles that are applied to the group.

View solution in original post

sjaworski
Communicator

Hi Samuelrey,

In Splunk 5.1.x
Navigate to Manager/Access Controls/Authentication method and click on "Configure Splunk to use LDAP and map groups"
Then select the "Map Groups" actions for your configured LDAP strategy.

The next view should give you the listing.

In Splunk 6.1.X and 6.2
Navigate to Settings/Access Controls/Authentication method and click on "Configure Splunk to use LDAP and map groups"
Then select the "Map Groups" actions for your configured LDAP strategy.

The next view should give you the listing.

cpetterborg
SplunkTrust
SplunkTrust

Settings -> Access Controls -> Authentication Method -> Configure Splunk to use LDAP and map groups -> Map Groups (under Actions for your LDAP configuration)

The Roles column will show if there is a role mapped to the LDAP group.

Select the LDAP group and you can select the roles that are applied to the group.

cmeo
Contributor

I'm deploying in a large enterprise which has hundreds of groups, of which I'm interested in maybe half a dozen. So this method isn't terribly convenient.

Can we please have a filter to show just the currently mapped groups and roles, or some sort of report that does this?

0 Karma

samuelrey
New Member

Thanks cpetterborg - That helped. I ordered by Role to save me going through all the pages. This gave the groups that are mapped right at the top of the first page.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...