Security

AuthenticationManagerLDAP Error Message and BaseDN setting

asarolkar
Builder

Hi All,

We are currently getting the following error

ERROR AuthenticationManagerLDAP - Could not find user="nobody" with strategy="LDAP DC02"
host=something

Not sure what error is causing this error.

Is it a known error message that appears when Splunk does not successfully bind to AD?
Is it a LDAP-role mapping issue ?
Should I perhaps be looking at BaseDN/groupbaseDN configuration ?

The user "nobody" looks a bit suspicious.

Tags (2)

NageswariV
Engager

HI, I find the same error with some of my users as well. how to resolve this issue? please help.

0 Karma

lmyrefelt
Builder

1.No
2. No, not really
3. No

I found dshpritz answer here helpfull;
http://answers.splunk.com/answers/49525/splunkdlog-error-message
Running; find /path/to/splunk/apps -iname *.meta -exec grep -il "nobody" {} ; gives me all objects owned by nobody and thus i can easily change it to an more appropriate context / user .
Hope it helps :slightly_smiling_face:

lmyrefelt
Builder
  1. No
  2. No, not really
  3. No

I found dshpritz answer here helpfull;
http://answers.splunk.com/answers/49525/splunkdlog-error-message

Running; find /path/to/splunk/apps -iname *.meta -exec grep -il "nobody" {} \; gives me all objects owned by nobody and thus i can easily change it to an more appropriate context / user .

Hope it helps :slightly_smiling_face:

0 Karma

xzjc3q
Explorer

I have the same issue as well. Would be interested in an answer.

0 Karma

gadjet
New Member

The user 'nobody' is supposed to be for 'configuration items' that aren't assigned a user.

I'm experiencing the same errors, and I would also like to know why it occurs, and how to stop it.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...