This is a Splunk TA to enable native python LDAP within Splunk.

You can either provide search results to this command, use options or use any stanza from ldap.conf.

All options that can be used:

server="STANZA"
specify LDAP server to be used, defaults to [default]
port="PORT"
specify LDAP port to be used, defaults to port in [default]
scope="SCOPE"
specify LDAP scope to be used in the search, defaults to sub
ldap_filter="LDAP_FILTER"
specify LDAP filter to be used in the search
base="BASEDN"
specify LDAP basedn to be used in the search, defaults to basedn in [default]
timelimit="TIMEOUT"
specify LDAP search timeout to be used, defaults to 30 seconds
sizelimit="LIMIT"
specify LDAP size limit to be used in the search, defaults to 5000 entries
attrs="ATTRS"
provide comma separated LDAP attributes to be returned, defaults to all
fetch="dc=example,dc=com"
provide DN to get all attributes from
response="yes"
use all default stanza settings and return LDAP search response times in milliseconds

INSTALLATION:

Install in UI or copy content into $SPLUNK_HOME/etc/apps
If you want to use anonymous bind, set password = 0 in ldap.conf
If the ldap command fails, enable debugging in the script $SPLUNK_HOME/etc/apps/TA-LDAP/bin/myldap.py log will be in $SPLUNK_HOME/var/log/splunk.
Python ldap module used in this app https://pypi.python.org/pypi/python-ldap/2.4.19 so make sure you meet all dependencies.

Add-on for LDAP

0