Multiple Roles inherited from LDAP Group Memberships

[dominiquevocat]

I have several indexes and created a role in splunk for each index. We have a RBAC system in place to grant users group memberships in our eDirectory based MetaDirectory. I map each splunk role to a LDAP groupmembership.

If a user has only one groupmembership all works fine.
If a user receives a second group membership it is shown fine in the user overview in Splunk Administration
The user does however not see the content of the index to which it received access by the second (N'th) group membership.

I modeled the role such that they have access to one index, the capability search and rtsearch.

What am i doing wrong?

[dominiquevocat · Accepted solution]

The roles were configured via the GUI and i assigned indizes to the roles. Seemingly each role had a srchFilter entry in the authorize.conf which caused the problem. Manually clearing the srchFilter from the authorize.conf seems to solve the issue.