Add-on for LDAP
Overview
Details
This is a Splunk TA to enable native python LDAP within Splunk.
You can either provide search results to this command, use options or use any stanza from ldap.conf.
All options that can be used:
-
server="STANZA"
specify LDAP server to be used, defaults to [default] -
port="PORT"
specify LDAP port to be used, defaults to port in [default] -
scope="SCOPE"
specify LDAP scope to be used in the search, defaults to sub -
ldap_filter="LDAP_FILTER"
specify LDAP filter to be used in the search -
base="BASEDN"
specify LDAP basedn to be used in the search, defaults to basedn in [default] -
timelimit="TIMEOUT"
specify LDAP search timeout to be used, defaults to 30 seconds -
sizelimit="LIMIT"
specify LDAP size limit to be used in the search, defaults to 5000 entries -
attrs="ATTRS"
provide comma separated LDAP attributes to be returned, defaults to all -
fetch="dc=example,dc=com"
provide DN to get all attributes from -
response="yes"
use all default stanza settings and return LDAP search response times in milliseconds
INSTALLATION:
- Install in UI or copy content into $SPLUNK_HOME/etc/apps
- If you want to use anonymous bind, set
password = 0inldap.conf - If the ldap command fails, enable debugging in the script
$SPLUNK_HOME/etc/apps/TA-LDAP/bin/myldap.pylog will be in$SPLUNK_HOME/var/log/splunk. - Python ldap module used in this app https://pypi.python.org/pypi/python-ldap/2.4.19 so make sure you meet all dependencies.