Security

Some splunk users not found/searchable from Access Control

sylim_splunk
Splunk Employee
Splunk Employee

We see inconsistent response in the UI (settings --> Users and Authentication --> access control --> users). Some users are not found, we know that the user recently accessed the platform. This makes it challenging to triage and review what role is being inherited by a specific user. This response and list of users can vary between search head cluster nodes that all point to the same LDAP environment.

Labels (1)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

It depends on the symptoms you have

i) Inconsistent list of user list;

If you have more than 1000 user information cached then it can happen. Maybe you can find different list of users for the same search string in different search head in SHC - cached users are not sync-ed among the SHC members. If you have many groups not relevant to the roles  they will occupy the cache slots. First off you may want to increase the "max_users_to_precache" to, like 50000 and see if it makes any differences.

[ldap] in limits.conf

max_users_to_precache = 50000 (1000 by default)

ii)Consistently missing users with specific capabilities( specific groups);

  There is a known issue with "grantableRoles" that doesn't display users in certain roles. Details found in another article:  https://community.splunk.com/t5/Security/Admin-can-t-see-users-with-a-certain-role-and-we-can-t-take...

 Simple workaround : have the admin using GUI inherit those capabilites..

iii) Further troubleshooting  if none of above works;

1) Turn on DEBUG for ScopedLDAPConnection, UserManagerPro and AuthenticationManagerLDAP in $SPLUNK_HOME/etc/log-local.cfg

2) splunk restart or rolling restart

3) capture diag within 3 minutes

4) delete $SPLUNK_HOME/etc/log-local.cfg

5) splunk restart or rolling restart

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

It depends on the symptoms you have

i) Inconsistent list of user list;

If you have more than 1000 user information cached then it can happen. Maybe you can find different list of users for the same search string in different search head in SHC - cached users are not sync-ed among the SHC members. If you have many groups not relevant to the roles  they will occupy the cache slots. First off you may want to increase the "max_users_to_precache" to, like 50000 and see if it makes any differences.

[ldap] in limits.conf

max_users_to_precache = 50000 (1000 by default)

ii)Consistently missing users with specific capabilities( specific groups);

  There is a known issue with "grantableRoles" that doesn't display users in certain roles. Details found in another article:  https://community.splunk.com/t5/Security/Admin-can-t-see-users-with-a-certain-role-and-we-can-t-take...

 Simple workaround : have the admin using GUI inherit those capabilites..

iii) Further troubleshooting  if none of above works;

1) Turn on DEBUG for ScopedLDAPConnection, UserManagerPro and AuthenticationManagerLDAP in $SPLUNK_HOME/etc/log-local.cfg

2) splunk restart or rolling restart

3) capture diag within 3 minutes

4) delete $SPLUNK_HOME/etc/log-local.cfg

5) splunk restart or rolling restart

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...