Security

Need more info about LDAP authorization internals

robgarner
Path Finder

Hi -

I have a working LDAP authentication/authorization configuration. There are no local users - all access is based on LDAP group membership and associated role definitions. A couple of our roles import "power" role. A couple of roles import other roles that import "power". There are multiple AD and OpenLDAP stores and some users are members of dozens of groups. Some of the LDAP groups import other LDAP groups (which a couple of "Answer" topics have indicated can be problematic).

1) I'd like guidance on constructing a query (preferably REST, but I'm not too fussy) that will show me which roles are importing "power" (or any other role or permssion, for that matter). Recursive would be icing on the cake.

2) Is there any equivalent of a "debug verbose" flag I can turn on in Splunk itself for authentication/authorization that will log all requests to and results from the LDAP servers ? I'm hoping for the equivalent of the "-d 1" flag for ldapsearch.

Thanks,
-Rob

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

Try starting with something like this and see what you want to do search-wise to drive to your answer.

| rest splunk_server=local /services/authorization/roles
| table title imported_roles
| rename title AS role

The splunk_server=local is going to show just that search head. If you remove that, it will return your indexers as well so you'll need to consolidate those results.

Let us know how that works out and we can iterate through.

Reference: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTaccess#authorization.2Froles

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Try starting with something like this and see what you want to do search-wise to drive to your answer.

| rest splunk_server=local /services/authorization/roles
| table title imported_roles
| rename title AS role

The splunk_server=local is going to show just that search head. If you remove that, it will return your indexers as well so you'll need to consolidate those results.

Let us know how that works out and we can iterate through.

Reference: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTaccess#authorization.2Froles

0 Karma

robgarner
Path Finder

Many thanks on the rest query; that'll get me started on the roles question.

How about LDAP troubleshooting; do you have any insight on how I could approach that ?

Grateful for your help!
-Rob

0 Karma

sloshburch
Splunk Employee
Splunk Employee

For LDAP troubleshooting, did you see this https://docs.splunk.com/Documentation/Splunk/latest/Security/TroubleshootSplunkSSO ? If you need more granular help, I'd suggest another post on answers where we can dig into it further (since this one is already answered and mostly covers a separate question).

0 Karma

robgarner
Path Finder

Good idea. Will check out your link and see where it takes me. Many thanks for all your help ! 🙂

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...