Security
Highlighted

LDAP connection with AD group group with 3K + plus users

New Member

Hello Together,

I have AD Group with 3000 plus users to be added in to LDAP settings in to splunk, But Users are not getting loaded when in connect the AD Group.

At the same time, if i use AD Groups with less user and then Iam able to see the users in splunk.

I use the following command in my configuration
user base DN = dc=abc,dc=com
userbase filter = (objectClass=user)
Group Base DN = dc=abc,dc=com

Static group search filter = (&(objectClass=group)(|(cn=AB01Splunkusers)(cn=AB02_domainUsers)))

Group name attribute = cn

AB02domainUsers has 3000 plus users and where as AB01Splunk_users has only 50 users.

CN for groups as :
CN=AB01Splunk_users,OU=Securitygroups,OU=Itspmg,OU=Applications,DC=abc,DC=com

CN=AB02domainUsers,CN=Users,DC=in,DC=abc,DC=com

Thanks

Labels (1)
0 Karma
Highlighted

Re: LDAP connection with AD group group with 3K + plus users

Motivator

google for "ldap 1000 record limit", this can be the cause.

There is a maxPageSize limit of 1000 in the windows AD which limits the LDAP query records to a max of 1000. In simple words whenever an LDAP search or query is made to the AD, no more than 1000 records are returned from the directory

you have to narrow your query to be below 1000 results or adjust ldap settings on the AD side to lift this restiction.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.