Hi Team,
Cisco Advanced Web Security Reporting v6.1 tool does not work correctly with LDAP.
This tool is actually Splunk 6.3 with Cisco app on top of it packaged in one piece to parse some Cisco WSA logs. After following configuration manual for LDAP authentication and department reporting I believe it does not work correctly.
Problem:
File /opt/cisco_wsa_reporting/etc/apps/cisco_wsa_reporting/lookups/departments.csv contains confusing content. Every LDAP user is a member of multiple groups. However I can see that script "discovery.py populated department field in csv file with value "Alef-CZ" which is NOT any of our groups. On top of that weird string " name" " folows in the next line. I know that "name" is one of LDAP object attributes.
I think there is a problem with parsing data from LDAP quiery via ldapsearch command in a script. However, not being python expert, I do not know how to fix it. There is no detailed documentation available.
departments.csv:
"user_id","displayName","department"
"login1","Firstname Surname","Alef-CZ
name"
"login2","Firstname2 Surname2","Alef-CZ
name"
...
Source of all available information:
http://www.cisco.com/c/dam/en/us/td/docs/security/wsa/Advanced_Reporting/WSA_Advanced_Reporting_6/Advanced_Web_Security_Reporting_6_1.pdf
Any ideas? Can Cisco DEV team look into it? I probably cannot open a TAC case as it's just evaluation.
Tomas
