topic Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ? in Security

How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

Hemnaath — Tue, 31 Jul 2018 13:00:59 GMT

Hi Splunkers, I am seeing some 2023 event counts for the below mentioned error detail in splunkd.log in all the indexer instances, so can any one guide me how /where to start the investigation on fixing this issue.

ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="test01". Search filter="(&(uniquemember=uid=test01,ou=Internal,ou=Users,dc=xxx,dc=com)(cn=Splunk_Admin))" strategy="XXXX LDAP"

Splunk Version : 7.0.4

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

renjith_nair — Tue, 31 Jul 2018 13:10:05 GMT

Looks like a LDAP configuration issue,

See if this answer helps

https://answers.splunk.com/answers/5415/how-can-i-append-basedn-to-member-uid-mappings-when-using-ldap-authentication.html

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

Hemnaath — Tue, 31 Jul 2018 14:27:18 GMT

hey renjith, thanks for your support on this, I am getting this error for only few users not all the users configured in the splunk via ldap. So as per Simon'S answer where/which location I should update the code, could you please guide me on that.

<code>groupMappingAttribute = uid
</code>

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

Hemnaath — Wed, 01 Aug 2018 10:07:57 GMT

hey can i get any help on this ...

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

sudosplunk — Wed, 01 Aug 2018 11:44:11 GMT

Hello, I had the same problem with 6.5.1, 6.5.2 and 6.5.3 (occasionally).
I noticed it only happens when we are running Real-time searches.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

Hemnaath — Wed, 01 Aug 2018 12:40:48 GMT

hey we are using 7.0.4 splunk version, but how did you fix the issue ? If you can share the knowledge it would be helpful as I could see some 2000 errors in splunkd.log related to this.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

sudosplunk — Wed, 01 Aug 2018 13:18:30 GMT

I am not sure if this behavior is still seen in 7.0.4. Please check if "real-time" searches are actually the culprits? Go to "Job Manager" page (Activity -> Jobs) to see if there are any real-time searches running. Kill the search to see if errors stopped.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

Hemnaath — Thu, 02 Aug 2018 11:19:18 GMT

Hi Nittala, I have seen some Jobs being executed by some users and those user details are getting popped in the splunkd.log as an Error, to validated I had followed above direction as mentioned on your comment and found those user Jobs where either completed or running stage in Activity-Jobs. But when checked with user on the same found that he did not execute any real-time search and he had checking data related past 7 days. So what will be the next step to this issue.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

renjith_nair — Thu, 02 Aug 2018 14:58:59 GMT

https://support.apple.com/kb/PH26272?viewlocale=en_ME&locale=en_ME

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

sudosplunk — Thu, 02 Aug 2018 18:57:58 GMT

I would suggest opening a support ticket with splunk. They can assist you better after analyzing diag file.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

Hemnaath — Tue, 29 Sep 2020 20:48:01 GMT

Hi All, When troubleshooting this issue with the help of splunker from splunk.answers.com , I had narrow down the issue and fixed it.

In this case the indexer and search head instances the LDAP configuration are different, in indexer instance only Splunk_Admin ldap group was configured, where as in search head we had other LDAP groups configured due to this when ever any user mapped apart from splunk_admin groups performs search activities it was throwing an error in splunkd.log due to the configuration conflict.

Problem Detail:
ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="test01". Search filter="(&(uniquemember=uid=test01,ou=Internal,ou=Users,dc=xxx,dc=com)(cn=Splunk_Admin))" strategy="XXXX LDAP"

Solution: Configured all the LDAP group in the indexer instance same as search head instances.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

jhall0007 — Fri, 17 Aug 2018 15:32:37 GMT

Was this issue causing any impact that you could identify? I am seeing a similar issue but I do not want to give users access to my indexers.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

Hemnaath — Fri, 17 Aug 2018 15:53:34 GMT

No it did not cause any issues.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

nikgoyal — Wed, 24 Oct 2018 22:41:32 GMT

Hemnaath are you able to resolve this issue. I have started facing this where in some users are unable to login. Not on consistent basis.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

Hemnaath — Thu, 25 Oct 2018 04:47:10 GMT

Hi Nikgoyal, Yes we were able to resolve this issue, by configuring all the LDAP group in the indexer instance same as search head instances.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

richgalloway — Tue, 13 Nov 2018 19:14:54 GMT

@Hemnaath If your problem is resolved, please accept an answer to help future readers.

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

bharathkumarnec — Tue, 27 Aug 2019 08:42:52 GMT

We have a lot of indexers, we need to add this to all the indexers??/

Re: How to troubleshoot ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user in splunkd.log ?

splunkoptimus — Thu, 11 Aug 2022 12:23:49 GMT

Check if the user belongs to groups which have permissions to access Splunk.