Until months ago the SA-LDAPsearch 2.1.4 (aka Splunk Support for Active Directory) app worked fine, and it still does for me as admin.
But it appears no alerts have come through for a lot of time now.
What users see when trying to query:
External search command 'ldaptestconnection' returned error code 1. Script output = " ERROR " # host: somedomain Could not access the directory service at ldaps://someserver:636: 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580" "
Their attempt or even |ldaptestconnection) results in index=_audit in events like these:
Audit:[timestamp=03-20-2017 11:18:15.673, id=*, user=xxxxx, action=list_storage_passwords, info=denied object="SA-ldapsearch:default:" operation=list]
Seems not good to grant any non-admin role this capability, but how other way can a specific group of users (or even a few) be given the possibility to run ldap searches?
Running Splunk 6.5.1 on Linux; had as always granted the Power role read-access to the App, users involved had the Power role.
... View more