We've been struggling to set up Splunk to use LDAP authentication for a while now. After finally getting it to bind successfully, it lists the groups when I map roles; however, when I log in as a user under a mapped role + group combo, it does not work. The DEBUG logs show the LDAP server returned no entries in search for DN="ou=Groups,dc=XXXX" filter="(&(memberuid=uid=XXXX,)(cn=*)"
A manual ldapsearch for the below does work:
ldapsearch -x -D "uid=XXXX,ou=XXX,dc=XXX" -W -H -b "ou=XXX,dc=XXX" "(&(memberuid=XXXX)(cn=*))"
It LOOKS in the logs like Splunk is trying to do this equivalent search:
ldapsearch -x -D "uid=XXXX,ou=XXX,dc=XXX" -W -H -b "ou=XXX,dc=XXX" "(&(memberuid=uid=XXXX,ou=XXX,dc=XXX)(cn=*))"
Specifically, if it would just not put the DN in the filter, it should work. Any advice to get this working?
