Security

User removed from LDAP but splunk still shows the user?

Vikuperi
New Member

Hi,

 

I have a use case where user has been removed from the LDAP , but when we check in the user via setting , we see the user still exists

 

Ideally automatically user should also be removed from splunk 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's normal.  Splunk consults the LDAP server when a user logs in, but the LDAP server does not notify Splunk when a user is removed (or added).

Once you've reassigned the user's assets to another user, you can delete the user manually.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...