Security

Error in Splunkd.log: UserManagerPro - Failed to LDAP user -- for a deleted user!

bnorthway
Path Finder

In my splunkd.log, these messages repeat constantly (several times per minute). I turned on INFO-level logging to see if the extra information is useful. This user, "bnorthway", is an OS user (Linux), but not an LDAP user. There also used to be a Splunk (non-LDAP) user, but this account has been deleted.

Why is Splunk trying to find this account on the LDAP server? How can I stop this?

ERROR AuthenticationManagerLDAP - Could not find user="bnorthway" with strategy="<domain>"
ERROR UserManagerPro - Failed to get LDAP user="bnorthway" from any configured servers
INFO  UserManagerPro - No user context available while checking capability=, auditInfo=""
0 Karma

rajanala
Path Finder

If the user bnorthway owns/created any Splunk artifacts ( like scheduled searches, alerts, etc) , you can change the ownership from bnorthway to nobody.

For example: To change the ownership for searches owned/created by bnorthway
Search for the user in local.meta under $SPLUNK_HOME/etc/apps/search/metadata/
replace all occurrences of owner = bnorthway to owner=nobody

sk314
Builder

As per the documentation, Splunk will check against all configured access strategies. By default, it searches Splunk local users first and then any other strategy configured.
(Ref: http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkToUsePAMOrRADIUSAuthentic... )

0 Karma

bnorthway
Path Finder

Where would I find the configuration that is attempting to find this user?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...