Unable to view LDAP group under Access controls

[vsidharda]

Hey Splunkers,

I have requested AD team to create a new LDAP group. They have created a new one and added users to that group.

But, I am unable to view that new AD group in Splunk UI under Access controls » Authentication method » LDAP strategies » LDAP Groups

Will Splunk show all the active LDAP groups in organization?.

How will Splunk filter and show the LDAP groups in the UI? Do we have to do any setting?

Thanks in advance !!

[codebuilder]

Assuming your AD team does not also manage Splunk, you will need a service account with credentials (Bind DN / Bind DN Password) in order to create a new LDAP binding, and then map the group itself.

[harsmarvania57]

Hi,

As far as I remember correctly it'll fetch 1000 results only, I'll suggest to use Static group search filter aka. groupBaseFilter in authorize.conf to filter out required group(s) or you can use wildcard as well like your all Splunk LDAP group starts with App-Splunk-BLABLA then you can use groupBaseFilter = (cn=APP-SPLUNK-*) in authorize.conf for LDAP strategy.

[vsidharda]

Yes, that filtering worked. Thanks !!

[harsmarvania57]

I have converted my comment to answer so that you can accept it.