Should I have the same authentication scheme on my indexers as on my SHC?

[lycollicott]

I have SAML on my SHC, but LDAP on my indexers. (There is a security rational for that, but I'm not going into those details.)

The splunkd.log on my indexers has these errors:

ERROR UserManagerPro - Could not get info for non-existent user="lycollicott@mydomain.com"

I would like to eliminate that error from clogging the internal logs, but don't know how.

[gjanders]

I have a Splunk bug logged where I get a:

Failed to get LDAP user from any
configured servers

This only happens on the indexer level, even though the searches are running from the search head. The fix is due in 6.5.3 which is hopefully due out soon.

It is a minor annoyance if you have hit the same issue...however there are other possibilities as per the comments above, I believe the issue appeared in 6.5.0 from memory...(or a late 6.4.x version)

[jkat54]

I'm thinking this user has a scheduled search that is running as the user however the user doesn't exist. Maybe did at one point but was removed from passwd manually?

[jkat54]

You'll have to change those single quotes to back ticks. I don't have them on my phones keyboard.

You may have to change the 10 to a larger number to see the stanza / saved search name too. -C in grep manes give me x lines before and after the match

[lycollicott]

No, that userid (mine) is SAML and different from LDAP, too. 😞

[mattymo]

Right, which is probably why you see the error, cause the idx is using ldap not saml, correct?

https://answers.splunk.com/answers/70946/how-does-splunk-manage-ldap-or-ad-user-created-objects-if-t...

[jkat54]

Did the indexers ever use SAML?

Chech out the folders here (assuming your on nix) on the indexers

/opt/splunk/etc/users/

Should be full of usernames and under there the individual user's knowledge objects.

That's a starting point. Beyond that there can be searches with runAs set to specific users.

Maybe could find those like this:

  for i in 'find /opt/splunk/etc -type f -name "savedsearches.conf" '; do echo;do echo $i; cat $i | grep -C 10 -i lycollicott; done