Unable to access IP Allow List page

Applicability

Description

When a user is trying to access the IP Allow List page via, Settings > Server Settings > IP Allow List the below error is presented -

JWT token creation failed. Invalid username or username not found

When navigating to Settings > Users > Edit > View Capabilities of the User in question above, the below error is presented - 

User XXXXXXX fetch failed. Failed to fetch user results.

Investigation

Navigate to Settings > Users and locate the needed user, then review all roles assigned to that specific user.

Cross check that all those roles exist on the UI - in this example, the ess_analyst was missing from the UI.

In this example, during navigation to the backend it was seen that the role ess_analyst was configured in the below:

etc/system/local/authentication.conf

[roleMap_SAML]ess_analyst = XXXXXX;XXXXXX;XXXXXX

Roles that are assigned in authentication.conf must also be created in the UI.

Resolution

The role ess_analyst was added with the below capabilities as listed out in the documentation - this stopped the error message appearing when on View Capabilities, and allowed the splunk administrator to access the IP Allow List page

ess_analyst is a Splunk role and inherits from the following roles, user, power, ess_user