Security

AuthenticationManagerLDAP Error Message and BaseDN setting

asarolkar
Builder

Hi All,

We are currently getting the following error

ERROR AuthenticationManagerLDAP - Could not find user="nobody" with strategy="LDAP DC02"
host=something

Not sure what error is causing this error.

Is it a known error message that appears when Splunk does not successfully bind to AD?
Is it a LDAP-role mapping issue ?
Should I perhaps be looking at BaseDN/groupbaseDN configuration ?

The user "nobody" looks a bit suspicious.

Tags (2)

NageswariV
Engager

HI, I find the same error with some of my users as well. how to resolve this issue? please help.

0 Karma

lmyrefelt
Builder

1.No
2. No, not really
3. No

I found dshpritz answer here helpfull;
http://answers.splunk.com/answers/49525/splunkdlog-error-message
Running; find /path/to/splunk/apps -iname *.meta -exec grep -il "nobody" {} ; gives me all objects owned by nobody and thus i can easily change it to an more appropriate context / user .
Hope it helps 🙂

lmyrefelt
Builder
  1. No
  2. No, not really
  3. No

I found dshpritz answer here helpfull;
http://answers.splunk.com/answers/49525/splunkdlog-error-message

Running; find /path/to/splunk/apps -iname *.meta -exec grep -il "nobody" {} \; gives me all objects owned by nobody and thus i can easily change it to an more appropriate context / user .

Hope it helps 🙂

0 Karma

xzjc3q
Explorer

I have the same issue as well. Would be interested in an answer.

0 Karma

gadjet
New Member

The user 'nobody' is supposed to be for 'configuration items' that aren't assigned a user.

I'm experiencing the same errors, and I would also like to know why it occurs, and how to stop it.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How to Break a Kubernetes Pod on Purpose and Let the AI Troubleshooting Agent Find ...

Let's say I've just rolled out a Kubernetes Deployment with a typo in the image tag. Nothing explodes. The pod ...

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

The updated Splunk Add-on for Microsoft Windows helps customers search Windows events faster by reducing ...

What's New in Splunk Enterprise Security 8.8 and Beyond

Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or ...