Security

Error in Splunkd.log: UserManagerPro - Failed to LDAP user -- for a deleted user!

bnorthway
Path Finder

In my splunkd.log, these messages repeat constantly (several times per minute). I turned on INFO-level logging to see if the extra information is useful. This user, "bnorthway", is an OS user (Linux), but not an LDAP user. There also used to be a Splunk (non-LDAP) user, but this account has been deleted.

Why is Splunk trying to find this account on the LDAP server? How can I stop this?

ERROR AuthenticationManagerLDAP - Could not find user="bnorthway" with strategy="<domain>"
ERROR UserManagerPro - Failed to get LDAP user="bnorthway" from any configured servers
INFO  UserManagerPro - No user context available while checking capability=, auditInfo=""
0 Karma

rajanala
Path Finder

If the user bnorthway owns/created any Splunk artifacts ( like scheduled searches, alerts, etc) , you can change the ownership from bnorthway to nobody.

For example: To change the ownership for searches owned/created by bnorthway
Search for the user in local.meta under $SPLUNK_HOME/etc/apps/search/metadata/
replace all occurrences of owner = bnorthway to owner=nobody

sk314
Builder

As per the documentation, Splunk will check against all configured access strategies. By default, it searches Splunk local users first and then any other strategy configured.
(Ref: http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkToUsePAMOrRADIUSAuthentic... )

0 Karma

bnorthway
Path Finder

Where would I find the configuration that is attempting to find this user?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...