LDAP queries (not authentication) via Splunk (lookup? something else?)

[howyagoin]

Hi,

Obviously Splunk has some native understanding of LDAP for authentication, but my desire is to use it to look up objects/people/whatever in our LDAP directory, but informational or enrichment purposes.

For example, if I've got a syslog entry which displays a user's username, and that's also their cn in our LDAP setup; I'd like to be able to map that back to their givenName at search time.

My first thought was to make a Python script which could be an external lookup - and I've got as far as that working and generating JSON output for a given input, but I'm not sure if that's the best approach, nor how to actually link that to Splunk.

In my ideal setup, I'd be able to do something akin to:

source=firewall failed | lookup ldap user | table user,givenName

And assuming that my firewall logs had nice and obvious "user=bob" values, then this command would grab all the matching data for cn=user (I realise I may have to do something with eval to set which LDAP attribute I want to lookup, it may not always be cn) and generate something like:

bob Robert Jones
sally Sally Smith
thelo Thelonious Monk

Is a lookup the right way to do this? I tried reading in some JSON data and using spath to make sense of it, but I'm not sure if that's the right option here - the ldapsearch will return several results, and a JSON array or Python list seemed to be the two best options given Splunk's preference for Python.

[alexantao]

I am also trying to do this.

Firt I tried the TA-LDAP command, but it is not helping, since it is not a lookup, but it works to get some information from OpenLDAP. MuS, the developer of TA-LDAP is helping me with this.

I'm trying to make my own lookup script (couldn't attach), but I'm get a lot of trouble:
1. made a python script to be the lookup. It works when I try on the commandline.
2. realized that it does not work as a lookup. Mainly because splunk's internal python lacks some modules, such as csv and ldap
3. tried to make a wrapper as I found on internet, but it is hard to make work. Still trying.

Please, if you manage to work, don't forget to mention here !

[smileyge]

you want the LDAPFILTER command