Security

Need more info about LDAP authorization internals

robgarner
Path Finder

Hi -

I have a working LDAP authentication/authorization configuration. There are no local users - all access is based on LDAP group membership and associated role definitions. A couple of our roles import "power" role. A couple of roles import other roles that import "power". There are multiple AD and OpenLDAP stores and some users are members of dozens of groups. Some of the LDAP groups import other LDAP groups (which a couple of "Answer" topics have indicated can be problematic).

1) I'd like guidance on constructing a query (preferably REST, but I'm not too fussy) that will show me which roles are importing "power" (or any other role or permssion, for that matter). Recursive would be icing on the cake.

2) Is there any equivalent of a "debug verbose" flag I can turn on in Splunk itself for authentication/authorization that will log all requests to and results from the LDAP servers ? I'm hoping for the equivalent of the "-d 1" flag for ldapsearch.

Thanks,
-Rob

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

Try starting with something like this and see what you want to do search-wise to drive to your answer.

| rest splunk_server=local /services/authorization/roles
| table title imported_roles
| rename title AS role

The splunk_server=local is going to show just that search head. If you remove that, it will return your indexers as well so you'll need to consolidate those results.

Let us know how that works out and we can iterate through.

Reference: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTaccess#authorization.2Froles

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Try starting with something like this and see what you want to do search-wise to drive to your answer.

| rest splunk_server=local /services/authorization/roles
| table title imported_roles
| rename title AS role

The splunk_server=local is going to show just that search head. If you remove that, it will return your indexers as well so you'll need to consolidate those results.

Let us know how that works out and we can iterate through.

Reference: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTaccess#authorization.2Froles

0 Karma

robgarner
Path Finder

Many thanks on the rest query; that'll get me started on the roles question.

How about LDAP troubleshooting; do you have any insight on how I could approach that ?

Grateful for your help!
-Rob

0 Karma

sloshburch
Splunk Employee
Splunk Employee

For LDAP troubleshooting, did you see this https://docs.splunk.com/Documentation/Splunk/latest/Security/TroubleshootSplunkSSO ? If you need more granular help, I'd suggest another post on answers where we can dig into it further (since this one is already answered and mostly covers a separate question).

0 Karma

robgarner
Path Finder

Good idea. Will check out your link and see where it takes me. Many thanks for all your help ! 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...