topic Re: How does Splunk manage LDAP or AD user-created objects if the user is no longer active? in Security

How does Splunk manage LDAP or AD user-created objects if the user is no longer active?

jbsplunk — Fri, 04 Jan 2013 23:07:41 GMT

I've got some users who are no longer around in my Splunk instance and I want to remove the user created objects. Is there a procedure I can follow for this task?

Re: How does Splunk manage LDAP or AD user-created objects if the user is no longer active?

ekost — Mon, 28 Sep 2020 13:03:18 GMT

The intersection of LDAP and Splunk users is a challenge when it comes to user-created objects, as Splunk won't clean-out user folders or other objects if their authentication fails.

-- splunkd.log errors seen--
ERROR UserManagerPro - Failed to get LDAP user="my_user" from any configured servers
ERROR AuthenticationManagerLDAP - Could not find user="my_user" with strategy="LDAP_or_AD_config"
ERROR ConfObjectManagerDB - Cannot initialize: /opt/splunk/search/splunk/etc/users/$userid/user-prefs/metadata/local.meta: No such file or directory
-- end splunkd.log example --

Back up the splunk/etc/users/$userid folder.
Search the files under splunk/etc/apps/ for the $userid string, which should show if the userid in question has ownership of a search or object that was elevated to Global permissions.
Note the files and paths (look for splunk/etc/apps/*/metadata/local.meta) and search inside them for the userid. Change the owner to an admin user or yourself or to a maintenance account. Whichever you find easier as long as the account can authenticate properly.
Restart Splunk services on the host.
Check splunkd.log on the search head to validate the LDAP auth errors have subsided.
Remove the splunk/etc/users/$userid folder.

Re: How does Splunk manage LDAP or AD user-created objects if the user is no longer active?

yannK — Fri, 11 Jan 2013 01:48:17 GMT

If you see many errors about missing user in the splunkd.log, this is because deleted LDAP users still own objects in splunk, by example a scheduled search.
and you should clean it
Delete the objects/profile or migrate them to another user or an app. See answer below.

Re: How does Splunk manage LDAP or AD user-created objects if the user is no longer active?

bosburn_splunk — Tue, 04 Feb 2014 17:56:05 GMT

For those of you on *Nix machines would be able to do something like this:

cd $SPLUNK_HOME/etc

for x in `find . -name 'local.meta'`; do cp $x $x.old ; sed s/olduser/newuser/ < $x > $x.new ; mv -f $x.new $x ; done

This will make a backup of the local.meta, swap out the olduser for the newuser and copy it over the local.meta. All you should have to do is restart Splunk.

Brian

Re: How does Splunk manage LDAP or AD user-created objects if the user is no longer active?

jravida — Tue, 26 May 2015 16:46:05 GMT

This is money

Re: How does Splunk manage LDAP or AD user-created objects if the user is no longer active?

LewisWheeler — Tue, 22 Dec 2015 17:29:23 GMT

I wrapped this up in a script and it works perfectly - really nice solution to the problem here, bit surprised Splunk haven't got something out of the box for you to fix this problem. We had a set of administrators leave and this caused some pain.

The only addition I would make. is automating the removal of the user id folder as explained above (after creating a backup) then perform a refresh (as mentioned in https://answers.splunk.com/answers/168898/how-can-we-find-all-the-searches-alerts-dashboard.html) for the config settings to take affect - I didn't need to restart the splunk services for this to work.

Warning: Make sure you test this in development environments first, has the chance to be very costly when overwriting so many config files in bulk, even if temporarily until it can be reverted.

Re: How does Splunk manage LDAP or AD user-created objects if the user is no longer active?

AZYeti — Thu, 03 Aug 2017 18:19:43 GMT

What about Splunk cloud users? Is this something that cloud ops needs to handle or can these items be migrated through the UI?

Re: How does Splunk manage LDAP or AD user-created objects if the user is no longer active?

LewisWheeler — Thu, 03 Aug 2017 19:31:48 GMT

Seeing as you don't have access to the configuration files as part of the Splunk Cloud SaaS solution - then it is 100% something Splunk should take care of. They SHOULD have alerting in place that notifies them when the error message comes up in the log entries, then resolve it - but I wouldn't be surprised if you also have to raise an incident to formally ask them to remove the user dir.

Re: How does Splunk manage LDAP or AD user-created objects if the user is no longer active?

ekost — Thu, 03 Aug 2017 19:49:01 GMT

Please note that with the release of Splunk 6.6, there's a feature to find, alert, and manage orphaned knowledge objects. The details are available in the documentation here. As an admin, you'd receive a daily alert, have a dashboard to review the objects, and an opportunity to reassign them to a different user. Reviewing the steps above, the "Orphaned Scheduled Searches, Reports, and Alerts" dashboard and UI to manage objects would replace Steps 2, 3, and 4 for most use-cases. Enjoy!