server error when accessing Search Head UI

Applicability

Description

A Splunk local user  is attempting to access the Search Head UI, this is a new user, other users are able to access as normal. The user enters the credentials, username and password, and after that a message is displayed as "server error", no other details are displayed on screen.

https://host.splunkcloud.com//en-US/account/login?loginType=splunk

Investigation

-The Search Head is up and running and accessible via Search Head UI, when searching for the user, the last login metric shows a recent mark as if the user was able to login.

-Looking at internal logs the following messages are found:

ERROR UiAuth [******* TcpChannelThread] - user=user action=login status=failure reason=bad-cval useragent="Mozilla/# (Windows NT #; Win#; x#) AppleWebKit/# (KHTML, like Gecko) Chrome/# Safari/# Edg/#" clientip=IP

-Allow list is correct based on the IP on the message.

-Noticed the URL used by the user has an extra "/" character:

https://host.splunkcloud.com//en-US/account/login?loginType=splunk

-Reproduced the issue: the URL loads properly without any warning or message, but when entering credentials and clicking on login it shows the "server error" message.

Resolution

Corrected URL as standard usage:

https://host.splunkcloud.com/en-US/account/login?loginType=splunk