Why is our Splunk LDAP / Active Directory authentication not showing security groups?

[dpratt9]

We've inherited a Splunk deployment that is authenticating against Active Directory with LDAP.

We can see users and distribution groups from AD, but not security groups.

Can you help point me in the right direction for why we cannot see security groups for managing access to our Splunk deployment?

[DOMAIN - ActiveDirectory]
SSLEnabled = 0
anonymous_referrals = 1
bindDN = <redacted>
bindDNpassword = 
charset = utf8
dynamicMemberAttribute = member
emailAttribute = mail
groupBaseDN = <redacted>
groupBaseFilter = (objectclass=group)
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = myserver.mydomain
nestedGroups = 1
network_timeout = 20
port = 666
realNameAttribute = displayname
sizelimit = 980
timelimit = 15
userBaseDN = <redacted>
userNameAttribute = samaccountname

[doksu]

Turning on debug level logging may help:

Setting > Server settings > Server logging > ScopedLDAPConnection > DEBUG
Setting > Server settings > Server logging > AuthenticationManagerLDAP > DEBUG

We had a similar issue and discovered that the LDAP query Splunk runs always has the filter: (displayname=*), so if an object doesn't have its display name populated, Splunk won't "see" the object.

[dpratt9]

So far we've been unable to see a (displayname=*) filter present in our LDAP queries when debugging. However, we did notice that our LDAP query is only displaying 2,000 (of 2,613) groups even after increasing our LDAP query limits on the Splunk side.

Continuing to dig...

[teunlaan]

Keep in mind Splunk only displays groups when the are Users in that group.

[dpratt9]

ahhh.... good point. Currently, the security group is populated with six users. We don't have a userBaseFilter set, is there anything else that could be masking the users on the Splunk side and preventing the group from being visible?