How to fix "Encountered the following error while trying to update: In handler 'users': Could not get info for role that does not exist: dbx_user"?

[glancaster]

Just posting this for others who may come across this issue,

I got the following banner message every time I tried to modify an account locally to for testing purposes:

Encountered the following error while trying to update: In handler 'users': Could not get info for role that does not exist: dbx_user

I removed the DBX app prior to this error. I removed all references of the dbx_user role from authorization.conf and authentication.conf, but the issue still persisted. I also found the app in SPLUNK_HOME/etc/disabled-apps and $SPLUNK_HOME/etc/saved apps and removed them both as I no longer needed this app .

Running grep -R dbx_user $SPLUNK_HOME/etc/

I found a reference to the dbx_user role in the $SPLUNK_HOME/etc/passwd file and removed it.

I can now manage local accounts again without the error hanging me up 🙂

Running Splunk 6.2.2 with SHC

[cblanton]

I encountered this error after connecting LDAP. Splunk added the role "exchange-admin" to the admin profile, but this role did not exist. I created a role with the same name and the issue was resolved.

[okunc]

I've been also facing similar issue [AuthenticationManagerSplunk - Could not get roles for user that does not exist] while everything was setup fine. The only missing thing was to register the Splunk license and then it's working - in such scenario the error message is a bit misleading.

So just FYI the LDAP auth with Splunk Enterprise Trial [can't verify any other flavors now] is not working until you license the indexer properly.

[mcxrisley08]

I recently had this issue as well and removing the role from the passwd file in the Splunk home directory fixed the issue. In my case it was looking for the "windows-admin" role, which was not listed in the available roles. This problem prevented me from creating accounts, editing accounts and creating roles. I noticed that one of my other indexes that was recently rebuilt has that role as well but it has no issues, so I'm assuming that this a default role when Splunk is setup and it somehow got removed from the roles on my other index.

[aoleske]

I know this is really late, but if someone new has this issue, hopefully this can help. (We just had it as well.) The issue for us was LDAP. Splunk and LDAP were not talking correctly, so it literally "Could not get info for role that does not exist." In our case, we had set up a SplunkAdmin account within LDAP, and added the various users to it. Splunk actually showed the accounts under Settings --> Access controls --> authentication method --> LDAP Settings --> , Map groups but when we tried to login or add a new user, we could not. We discovered that the part of the LDAP search tree we had defined in Splunk when configuring splunk authentication did not actually contain the user accounts in LDAP. Our solution was to back up one level in the Splunk LDAP tree definition. This searched ALL the LDAP directories and found the various accounts.

[saikatr]

If you have another user (admin) who does not have the same role assigned (dbx_user in your case), you can ask that user to go to the Access controls console and delete the particular role from your account. The role may not be visible to you but its visible to other users if they look at your account. This will help you save the trouble of modifying the passwd file.

[glancaster · Accepted solution]

Once assigning a role to a local user, Splunk seems to assign that role to the user in the passwd file as well. If you remove that role you will most likely receive the same error stated in the title of this post.

Edit the passwd file in $SPLUNK_HOME/etc/ and remove all occurrences of the role mentioned in the error within the file and restart Splunk.

Hope this helps!