Security

Should I have the same authentication scheme on my indexers as on my SHC?

lycollicott
Motivator

I have SAML on my SHC, but LDAP on my indexers. (There is a security rational for that, but I'm not going into those details.)

The splunkd.log on my indexers has these errors:

ERROR UserManagerPro - Could not get info for non-existent user="lycollicott@mydomain.com"

I would like to eliminate that error from clogging the internal logs, but don't know how.

gjanders
SplunkTrust
SplunkTrust

I have a Splunk bug logged where I get a:

Failed to get LDAP user from any
configured servers

This only happens on the indexer level, even though the searches are running from the search head. The fix is due in 6.5.3 which is hopefully due out soon.

It is a minor annoyance if you have hit the same issue...however there are other possibilities as per the comments above, I believe the issue appeared in 6.5.0 from memory...(or a late 6.4.x version)

0 Karma

jkat54
SplunkTrust
SplunkTrust

I'm thinking this user has a scheduled search that is running as the user however the user doesn't exist. Maybe did at one point but was removed from passwd manually?

0 Karma

jkat54
SplunkTrust
SplunkTrust

You'll have to change those single quotes to back ticks. I don't have them on my phones keyboard.

You may have to change the 10 to a larger number to see the stanza / saved search name too. -C in grep manes give me x lines before and after the match

0 Karma

lycollicott
Motivator

No, that userid (mine) is SAML and different from LDAP, too. 😞

0 Karma

mattymo
Splunk Employee
Splunk Employee

Right, which is probably why you see the error, cause the idx is using ldap not saml, correct?

https://answers.splunk.com/answers/70946/how-does-splunk-manage-ldap-or-ad-user-created-objects-if-t...

- MattyMo
0 Karma

jkat54
SplunkTrust
SplunkTrust

Did the indexers ever use SAML?

Chech out the folders here (assuming your on nix) on the indexers

/opt/splunk/etc/users/

Should be full of usernames and under there the individual user's knowledge objects.

That's a starting point. Beyond that there can be searches with runAs set to specific users.

Maybe could find those like this:

  for i in 'find /opt/splunk/etc -type f -name "savedsearches.conf" '; do echo;do echo $i; cat $i | grep -C 10 -i lycollicott; done
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...