Security

AuthenticationManagerLDAP Error Message and BaseDN setting

asarolkar
Builder

Hi All,

We are currently getting the following error

ERROR AuthenticationManagerLDAP - Could not find user="nobody" with strategy="LDAP DC02"
host=something

Not sure what error is causing this error.

Is it a known error message that appears when Splunk does not successfully bind to AD?
Is it a LDAP-role mapping issue ?
Should I perhaps be looking at BaseDN/groupbaseDN configuration ?

The user "nobody" looks a bit suspicious.

Tags (2)

NageswariV
Engager

HI, I find the same error with some of my users as well. how to resolve this issue? please help.

0 Karma

lmyrefelt
Builder

1.No
2. No, not really
3. No

I found dshpritz answer here helpfull;
http://answers.splunk.com/answers/49525/splunkdlog-error-message
Running; find /path/to/splunk/apps -iname *.meta -exec grep -il "nobody" {} ; gives me all objects owned by nobody and thus i can easily change it to an more appropriate context / user .
Hope it helps 🙂

lmyrefelt
Builder
  1. No
  2. No, not really
  3. No

I found dshpritz answer here helpfull;
http://answers.splunk.com/answers/49525/splunkdlog-error-message

Running; find /path/to/splunk/apps -iname *.meta -exec grep -il "nobody" {} \; gives me all objects owned by nobody and thus i can easily change it to an more appropriate context / user .

Hope it helps 🙂

0 Karma

xzjc3q
Explorer

I have the same issue as well. Would be interested in an answer.

0 Karma

gadjet
New Member

The user 'nobody' is supposed to be for 'configuration items' that aren't assigned a user.

I'm experiencing the same errors, and I would also like to know why it occurs, and how to stop it.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...