Security

A user seems to not exist, has anyone encountered such a thing?

PickleRick
SplunkTrust
SplunkTrust

I've stumbled today on a strange thing. It started out with a case about user hitting quota limits. But when I dug into that deeper it turned out that the user doesn't show in the system.

It's not displayed in the UI, it doesn't show in the REST output of /services/authentication/users

But it is defined in etc/passwd so it can log in. And it has KOs created and assigned to it (most importantly in my case - scheduled searches). It has a role assigned in etc/passwd and it seems that that role is properly enforced (hence the quota limitations).

Anyone encountered such thing? How could such user have been "lost"?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

i have had same situation on one client’s environment. The reason was that there was several inherited roles which has opposite capabilities set. Probably the best way to solve this is just comment out one inherited role one after one. They have LDAP authentication and authorization with configured both conf files in apps and directly with gui. I switched this to pure conf files in one app.

One app which could help you is https://splunkbase.splunk.com/app/4111.  I just take some queries from it and modified those to get better understanding what they have defined.

r. Ismo

PickleRick
SplunkTrust
SplunkTrust

Thanks for the hint! As far as I remember, this customer has single role per user but I'll see if other users with this role are visible (so far I focused on this single user).

I'll check it later and report the findings 🙂

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It seems that indeed there are some roles that - when assigned make the user "disappear".

Will have to dig in which role settings do that.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...