- Find Answers
- :
- Splunk Platform
- :
- Splunk Enterprise
- :
- Authentication.conf error
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
I'm currently facing an issue where i migrated the /etc/users/* from a standalone ES SH into the deployer's shcluster/apps/ to be deployed to the 3 SHC members.
Also the authentication.conf in the system/local for the SHC members are set up for LDAP mapped authentication.
After deploying and reloading authentication, the SHC(3) members does not* reflect the same amount of users on the individual search heads.
Is this error a bug or any reason why the Users list is not populating correctly from the ldap
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The issue was with the capitalization of the User base DN setting, instead of
dc=<something>,dc=com,dc=sg
I used
DC=<something>,DC=com,DC=sg
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The issue was with the capitalization of the User base DN setting, instead of
dc=<something>,dc=com,dc=sg
I used
DC=<something>,DC=com,DC=sg
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What problem are you facing ? Do you mean that no. of users exist in standalone SH are more compare to SHC ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How you deployed authentication.conf, I'll suggest you to deploy it from deployer to SHC members so that it will be unique on all your SHC members.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
