Help needed with the user/password logon

[damucka]

Hello,

I have really urgent issue:
- We use LDAP authentication in our instance, it worked fine for quite long. Now, there were some maintenance changes on the DLs / LDAP side and since yesterday many important users in my Splunk are just gone. They are in the corresponding DLs, I synchronized the authentication details ... nothing helps.
This issue will be surely solved somehow someday, but if I do not grant back the access to my Splunk to couple of people immediately, I will loose their trust in the solution.
So, I created manually a new user Mickey Mouse and would like him to access the instance by giving the user/password.
- How do I configure it properly?
- Are there any additional parameters to change on the instance in order to make it possible?
- Both LDAP and "manual-Mickey" authentication should be possible in the same time, because strangely most of the users are there, just some are missing, and the rest of them should be able to use LDAP authentication as usual
- What link should the Mickey use to reach the user/password logon page?

Please see also the attached pictures.

Kind Regards,
Kamil

[harsmarvania57 · Accepted solution]

Hi,

To workaround this issue, you can create local user with same userid as their LDAP userid so that hose users can access their Knowledge Objects and any modification in those knowledge objects or creation of new knowledge objects will be available to same user when you restore your LDAP issue.

In Splunk local user has higher precedence then LDAP, have a look at https://docs.splunk.com/Documentation/Splunk/8.0.3/Security/SetupuserauthenticationwithLDAP#Authenti...

[damucka]

Thank you, the workaround sounds good.
However, in the meantime we noticed that the users (there was actually one user who was not able to logon, the rest are missing in the "user" overview, but are able to logon strangely), so this one user had an issue with the browser and also himself can logon.
I interpreted this as an LDAP issue, because the users are missing in the Splunk list so I thought they do not get replicated. But this is not the case. They are able to logon, but their names are not on the users list ....

I found the similar case in the Questions, but unfortunately after commenting out the mentioned parameter and restarting instance, nothing changed:
https://answers.splunk.com/answers/734939/why-are-we-unable-to-retrieve-the-list-of-all-ldap.html

Would you have any idea or should I create a support case?

Kind Regards,
Kamil

[harsmarvania57]

How many users do you have, is it more than 1000? If that is not the case then I'll suggest to go with Splunk Support.

[damucka]

We have around 160 users.
Yes, I will open a new support case.
Thank you for the idea with the workaround.

Kind Regards,
Kamil

[harsmarvania57]

Welcome 🙂