I've been also facing similar issue [AuthenticationManagerSplunk - Could not get roles for user that does not exist] while everything was setup fine. The only missing thing was to register the Splunk license and then it's working - in such scenario the error message is a bit misleading. So just FYI the LDAP auth with Splunk Enterprise Trial [can't verify any other flavors now] is not working until you license the indexer properly. ... View more