topic Re: How do you resolve splunk.log error messages after switching authentication from LDAP to SAML? in Security

How do you resolve splunk.log error messages after switching authentication from LDAP to SAML?

DennisFFM — Tue, 07 Nov 2017 18:04:48 GMT

Hey guys,

After changing our authentication system from LDAP to SAML we get a lot of messages like this in splunkd.log:

11-07-2017 18:35:00.904 +0100 WARN UserManagerPro - AQR not supported and user=system information not found in cache

All I could find out by myself is, that "AQR" is likely to mean "Assessor qualification & requirements" and it has something to do with SAML.

Can anybody help here?

Greetings
Dennis

Re: How do you resolve splunk.log error messages after switching authentication from LDAP to SAML?

maciep — Sat, 11 Nov 2017 15:17:07 GMT

it might be worth opening a case with Splunk Support. Looks like someone else is seeing this recently as well

https://answers.splunk.com/answers/588332/what-is-aqr-and-why-is-it-throwing-warning-message-1.html

Re: How do you resolve splunk.log error messages after switching authentication from LDAP to SAML?

lycollicott — Thu, 25 Jan 2018 19:22:17 GMT

AQR= attributeQueryRequest

I'm actually on a webex with Splunk Support on this very thing right now.

Re: How do you resolve splunk.log error messages after switching authentication from LDAP to SAML?

lycollicott — Thu, 25 Jan 2018 19:57:45 GMT

Dennis, we've been trying to figure this out for a while now and I've had a few Webex on it. The analyst and I think it's probably a bug and probably harmless, but we might also have a temporary workaround.

We created a local splunk user called system and gave it a weak role ....those messages ended immediately. I'll keep you updated.

Re: How do you resolve splunk.log error messages after switching authentication from LDAP to SAML?

woodcock — Thu, 28 Jun 2018 13:23:22 GMT

So did you ever get an answer, @lycollicott?

Re: How do you resolve splunk.log error messages after switching authentication from LDAP to SAML?

scannon4 — Thu, 28 Jun 2018 13:28:18 GMT

That is what we did as well as a workaround, lycollicott

Re: How do you resolve splunk.log error messages after switching authentication from LDAP to SAML?

DennisWoerner — Thu, 28 Jun 2018 13:32:49 GMT

Hi @lycollicott,

Thank you for your answer!
That sounds like a good workaround.

I didn't investigate this error any further, as it isn't really a 'problem'.

Do you have already an update on this?

Re: How do you resolve splunk.log error messages after switching authentication from LDAP to SAML?

lycollicott — Mon, 09 Jul 2018 19:16:04 GMT

Nothing beyond the workaround.

Re: How do you resolve splunk.log error messages after switching authentication from LDAP to SAML?

lycollicott — Mon, 09 Jul 2018 19:16:59 GMT

There is nothing new to report on this, but the workaround is still in place.