Security
Highlighted

Some splunk users not found/searchable from Access Control

Builder

We see inconsistent response in the UI (settings --> Users and Authentication --> access control --> users). Some users are not found, we know that the user recently accessed the platform. This makes it challenging to triage and review what role is being inherited by a specific user. This response and list of users can vary between search head cluster nodes that all point to the same LDAP environment.

Labels (1)
0 Karma
Highlighted

Re: Some splunk users not found/searchable from Access Control

Builder

It depends on the symptoms you have

i) Inconsistent list of user list;

If you have more than 1000 user information cached then it can happen. Maybe you can find different list of users for the same search string in different search head in SHC - cached users are not sync-ed among the SHC members. If you have many groups not relevant to the roles  they will occupy the cache slots. First off you may want to increase the "max_users_to_precache" to, like 50000 and see if it makes any differences.

[ldap] in limits.conf

max_users_to_precache = 50000 (1000 by default)

ii)Consistently missing users with specific capabilities;

  There is a known issue with "grantableRoles" that doesn't display users in certain roles. Details found in another article:  https://community.splunk.com/t5/Security/Admin-can-t-see-users-with-a-certain-role-and-we-can-t-take...

iii) Further troubleshooting  if none of above works;

1) Turn on DEBUG for ScopedLDAPConnection, UserManagerPro and AuthenticationManagerLDAP in $SPLUNK_HOME/etc/log-local.cfg

2) splunk restart or rolling restart

3) capture diag within 3 minutes

4) delete $SPLUNK_HOME/etc/log-local.cfg

5) splunk restart or rolling restart

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.