Security

Should I have the same authentication scheme on my indexers as on my SHC?

lycollicott
Motivator

I have SAML on my SHC, but LDAP on my indexers. (There is a security rational for that, but I'm not going into those details.)

The splunkd.log on my indexers has these errors:

ERROR UserManagerPro - Could not get info for non-existent user="lycollicott@mydomain.com"

I would like to eliminate that error from clogging the internal logs, but don't know how.

gjanders
SplunkTrust
SplunkTrust

I have a Splunk bug logged where I get a:

Failed to get LDAP user from any
configured servers

This only happens on the indexer level, even though the searches are running from the search head. The fix is due in 6.5.3 which is hopefully due out soon.

It is a minor annoyance if you have hit the same issue...however there are other possibilities as per the comments above, I believe the issue appeared in 6.5.0 from memory...(or a late 6.4.x version)

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma

jkat54
SplunkTrust
SplunkTrust

I'm thinking this user has a scheduled search that is running as the user however the user doesn't exist. Maybe did at one point but was removed from passwd manually?

0 Karma

jkat54
SplunkTrust
SplunkTrust

You'll have to change those single quotes to back ticks. I don't have them on my phones keyboard.

You may have to change the 10 to a larger number to see the stanza / saved search name too. -C in grep manes give me x lines before and after the match

0 Karma

lycollicott
Motivator

No, that userid (mine) is SAML and different from LDAP, too. 😞

0 Karma

mattymo
Splunk Employee
Splunk Employee

Right, which is probably why you see the error, cause the idx is using ldap not saml, correct?

https://answers.splunk.com/answers/70946/how-does-splunk-manage-ldap-or-ad-user-created-objects-if-t...

0 Karma

jkat54
SplunkTrust
SplunkTrust

Did the indexers ever use SAML?

Chech out the folders here (assuming your on nix) on the indexers

/opt/splunk/etc/users/

Should be full of usernames and under there the individual user's knowledge objects.

That's a starting point. Beyond that there can be searches with runAs set to specific users.

Maybe could find those like this:

  for i in 'find /opt/splunk/etc -type f -name "savedsearches.conf" '; do echo;do echo $i; cat $i | grep -C 10 -i lycollicott; done
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!