cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
skashyap
Explorer
Member since: ‎10-20-2017
‎06-05-2020
Community Statistics
Posts 5
Solutions 1
Karma Given 0
Karma Received 0
Member Since ‎10-20-2017
Activity Feed
View All

Re: Why are our LDAP logins getting assigned to th...

by in Security
‎01-03-2019 07:48 AM
‎01-03-2019 07:48 AM
I resolved the issue after some tinkering around. Short answer: I had to fix the LDAP connection configuration to look at groups for authentication. More details: Somehow, the LDAP connection configuration was modified so that it was looking at individual users not groups (groupMappingAttribute, groupMemberAttribute and groupNameAttribute set to userNameAttribute value.) Hence it was ignoring all settings assigning roles to the group (in the authentication.conf rolemap). I am still not clear why Splunk by default assigned every user the admin role but the question is kind of moot now. Thanks for all your inputs and suggestions. ... View more

Re: Why are our LDAP logins getting assigned to th...

by in Security
‎01-02-2019 12:10 PM
‎01-02-2019 12:10 PM
Good point. In my authenticate.conf above, "ONC-IntOps Splunk Viewers-gs" is the full name of ONE group. Does Splunk have an issue with spaces in the LDAP group name? Still curious. ... View more

Re: Why are our LDAP logins getting assigned to th...

by in Security
‎01-02-2019 10:21 AM
‎01-02-2019 10:21 AM
I ran both and the values shown in the logs from both are what is set in the authorize and authentication conf files. For example role_map stanza shows the values set - no sign of any unexpected role being assigned. ... View more

Re: Why are our LDAP logins getting assigned to th...

by in Security
‎12-31-2018 01:14 PM
‎12-31-2018 01:14 PM
No untoward items in the \Program Files\Splunk\etc\system\local\authentication.conf at least. Any other files\settings that could be affecting this? ... View more

Why are our LDAP logins getting assigned to the ad...

by in Security
‎12-31-2018 10:25 AM
‎12-31-2018 10:25 AM
Hi, I have been trying to debug this for over a month now. Also checked with other Splunk experts who are also stumped. Hence resorting to Splunk answers. I hope this has a simple answer. I have a LDAP (AD) integrated Splunk with the following roles assigned to our LDAP security group "ONC-IntOps Splunk Viewers-gs" - user and viewers (dont ask why I need both). This worked great in that it allowed authorized users read access by just adding/removing them from the group... till last month :-(. I don't know what changed but now every time an (LDAP) user logs in for the first time, she/he gets auto-assigned to user, viewers and ALSO admin roles! This is the role map configuration section of the authentication.conf. I swear - nothing more. [roleMap_ActiveDirectory] admin = abc123 user = ONC-IntOps Splunk Viewers-gs viewers = ONC-IntOps Splunk Viewers-gs Any idea why every user gets assigned the admin role? Regards, -Srinath ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM