Unable to see other SAML user

Applicability

Description

One SAML user with the capability  "sc_admin" was not able to find another SAML user with the same capability "sc_admin"  when  going to "setting > users and searching the username"  

Investigation

User 1 who was trying to search the other SAML user was assigned with custom capability along with "sc_admin" role.  User 1 was assigned with one custom role and "sc_admin" .

User 2 who user 1 was not able to find was also assigned with various custom roles along with "sc_admin".

I accessed the search head and tried to search user 2 and I was able to see user 2 which suggest that their might be capability issue.

One by one I compared all the roles of user 2 with "sc_admin" role as "sc_admin" is the highest role that was assigned to both the users

Resolution

User 2 was assigned with a custom role which has the capability “dispatch_rest_to_indexers” which can only be assigned to "admin" role not even "sc_admin" has “dispatch_rest_to_indexers” capability.



From the above image left is custom role capabilities and right is "sc_admin" capabilities where the custom role is assigned with “dispatch_rest_to_indexers”  capability and  "sc_admin" does not have this capability

After removing the capability “dispatch_rest_to_indexers” from custom role for user 2. User 1 was able to see user 2 without any issue by going to "setting > users > searching the name of user 2"

Related Links

To see which capability is assigned to which Splunk default role - Roles and capabilities