Need more info about LDAP authorization internals

[robgarner]

Hi -

I have a working LDAP authentication/authorization configuration. There are no local users - all access is based on LDAP group membership and associated role definitions. A couple of our roles import "power" role. A couple of roles import other roles that import "power". There are multiple AD and OpenLDAP stores and some users are members of dozens of groups. Some of the LDAP groups import other LDAP groups (which a couple of "Answer" topics have indicated can be problematic).

1) I'd like guidance on constructing a query (preferably REST, but I'm not too fussy) that will show me which roles are importing "power" (or any other role or permssion, for that matter). Recursive would be icing on the cake.

2) Is there any equivalent of a "debug verbose" flag I can turn on in Splunk itself for authentication/authorization that will log all requests to and results from the LDAP servers ? I'm hoping for the equivalent of the "-d 1" flag for ldapsearch.

Thanks,
-Rob

[sloshburch · Accepted solution]

Try starting with something like this and see what you want to do search-wise to drive to your answer.

| rest splunk_server=local /services/authorization/roles
| table title imported_roles
| rename title AS role

The splunk_server=local is going to show just that search head. If you remove that, it will return your indexers as well so you'll need to consolidate those results.

Let us know how that works out and we can iterate through.

Reference: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTaccess#authorization.2Froles

[robgarner]

Many thanks on the rest query; that'll get me started on the roles question.

How about LDAP troubleshooting; do you have any insight on how I could approach that ?

Grateful for your help!
-Rob

[sloshburch]

For LDAP troubleshooting, did you see this https://docs.splunk.com/Documentation/Splunk/latest/Security/TroubleshootSplunkSSO ? If you need more granular help, I'd suggest another post on answers where we can dig into it further (since this one is already answered and mostly covers a separate question).

[robgarner]

Good idea. Will check out your link and see where it takes me. Many thanks for all your help ! 🙂