LDAP User not Showing Up in the User List Panel in Splunk.

Applicability

Description

The user was being displayed as expected in the Splunk "Users" panel, but when the Splunk Admin moved the user from one security group to another security group in AD, and remap the user role, the user disappeared from the "Users" list in Splunk.

Tried to revert the change, but it was not showing the user in the "User" panel in Splunk anymore.

 

Investigation

- Reloaded authentication configuration.

- Removed the information related to the user from Splunk:
Access controls » Authentication method » LDAP strategies

CN=test,OU=Staff,OU=Staff Users,DC=US,DC=CA,DC=GB,DC=AU

Restart Splunk.


- Checked the configuration on the Domain Controller, using these commands:
1. dsquery user -name Administrator (Instead of using "Administrator" use the username that can bind to LDAP)

2. dsquery user -name username_here (Instead of "username_here" use one of the usernames that you want to use in Splunk)

3. dsquery group -name "group_name_here" (Instead of "group_name_here" use the group where the users are located)

Use the information above to enter the information for LDAP one more time in:

Access controls » Authentication method » LDAP strategies

- double-checked the values in LDAP manually as well.
- The user was part of the correct group.
- Set up Splunk in debug mode in Server settings » Server logging:
 

category.AuthenticationManagerLDAP=DEBUG 
category.ScopedLDAPConnection=DEBUG

- Splunkd.log showed that the user was being listed with other users:
 

DEBUG AuthenticationManagerLDAP - Listing cached user="otheruser1"
DEBUG AuthenticationManagerLDAP - Listing cached user="otheruser2"

Resolution

- Removed the user-readonly role and let only the user role and it worked.

- Realized the role didn't have the capability "list_introspection" in the role role_user-readonly.
That was not allowing the user to be displayed in the "Users" panel in Splunk.
After adding the "list_introspection" capability the issue was solved.

 

Related Links

Splunk Documentation:
single-user-not-showing-up-in-ldap-user-list.html

Test your LDAP configuration:
TestyourLDAPconfiguration