Security

Some splunk users not found/searchable from Access Control

sylim_splunk
Splunk Employee
Splunk Employee

We see inconsistent response in the UI (settings --> Users and Authentication --> access control --> users). Some users are not found, we know that the user recently accessed the platform. This makes it challenging to triage and review what role is being inherited by a specific user. This response and list of users can vary between search head cluster nodes that all point to the same LDAP environment.

Labels (1)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

It depends on the symptoms you have

i) Inconsistent list of user list;

If you have more than 1000 user information cached then it can happen. Maybe you can find different list of users for the same search string in different search head in SHC - cached users are not sync-ed among the SHC members. If you have many groups not relevant to the roles  they will occupy the cache slots. First off you may want to increase the "max_users_to_precache" to, like 50000 and see if it makes any differences.

[ldap] in limits.conf

max_users_to_precache = 50000 (1000 by default)

ii)Consistently missing users with specific capabilities( specific groups);

  There is a known issue with "grantableRoles" that doesn't display users in certain roles. Details found in another article:  https://community.splunk.com/t5/Security/Admin-can-t-see-users-with-a-certain-role-and-we-can-t-take...

 Simple workaround : have the admin using GUI inherit those capabilites..

iii) Further troubleshooting  if none of above works;

1) Turn on DEBUG for ScopedLDAPConnection, UserManagerPro and AuthenticationManagerLDAP in $SPLUNK_HOME/etc/log-local.cfg

2) splunk restart or rolling restart

3) capture diag within 3 minutes

4) delete $SPLUNK_HOME/etc/log-local.cfg

5) splunk restart or rolling restart

View solution in original post

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

It depends on the symptoms you have

i) Inconsistent list of user list;

If you have more than 1000 user information cached then it can happen. Maybe you can find different list of users for the same search string in different search head in SHC - cached users are not sync-ed among the SHC members. If you have many groups not relevant to the roles  they will occupy the cache slots. First off you may want to increase the "max_users_to_precache" to, like 50000 and see if it makes any differences.

[ldap] in limits.conf

max_users_to_precache = 50000 (1000 by default)

ii)Consistently missing users with specific capabilities( specific groups);

  There is a known issue with "grantableRoles" that doesn't display users in certain roles. Details found in another article:  https://community.splunk.com/t5/Security/Admin-can-t-see-users-with-a-certain-role-and-we-can-t-take...

 Simple workaround : have the admin using GUI inherit those capabilites..

iii) Further troubleshooting  if none of above works;

1) Turn on DEBUG for ScopedLDAPConnection, UserManagerPro and AuthenticationManagerLDAP in $SPLUNK_HOME/etc/log-local.cfg

2) splunk restart or rolling restart

3) capture diag within 3 minutes

4) delete $SPLUNK_HOME/etc/log-local.cfg

5) splunk restart or rolling restart

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...