Some splunk users not found/searchable from Access Control

[sylim_splunk]

We see inconsistent response in the UI (settings --> Users and Authentication --> access control --> users). Some users are not found, we know that the user recently accessed the platform. This makes it challenging to triage and review what role is being inherited by a specific user. This response and list of users can vary between search head cluster nodes that all point to the same LDAP environment.

[sylim_splunk · Accepted solution]

It depends on the symptoms you have

i) Inconsistent list of user list;

If you have more than 1000 user information cached then it can happen. Maybe you can find different list of users for the same search string in different search head in SHC - cached users are not sync-ed among the SHC members. If you have many groups not relevant to the roles  they will occupy the cache slots. First off you may want to increase the "max_users_to_precache" to, like 50000 and see if it makes any differences.

[ldap] in limits.conf

max_users_to_precache = 50000 (1000 by default)

ii)Consistently missing users with specific capabilities( specific groups);

  There is a known issue with "grantableRoles" that doesn't display users in certain roles. Details found in another article:  https://community.splunk.com/t5/Security/Admin-can-t-see-users-with-a-certain-role-and-we-can-t-take...

 Simple workaround : have the admin using GUI inherit those capabilites..

iii) Further troubleshooting  if none of above works;

1) Turn on DEBUG for ScopedLDAPConnection, UserManagerPro and AuthenticationManagerLDAP in $SPLUNK_HOME/etc/log-local.cfg

2) splunk restart or rolling restart

3) capture diag within 3 minutes

4) delete $SPLUNK_HOME/etc/log-local.cfg

5) splunk restart or rolling restart