I followed the instructions in this answer (and their comments too) but I can't copy the user's roles from one Splunk to another.
Where are user's roles stored? I checked the $SPLUNK_HOME/etc/users
folder and it does not seem to contain such information.
I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd
file. So I you have also to copy that file if you want to sync users between two Splunk instances.
To recap:
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:
I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd
file. So I you have also to copy that file if you want to sync users between two Splunk instances.
To recap:
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:
passed file is for local authentication only and not Roles and Privileges.
Connection between roles and users are stored in that file. Please check.
authorize.conf does only contains roles, not connection between users and roles.
Also from the path "somesoni2" as mentioned, from authorize.conf you will have to copy the contents of the stanza which starts as below.
[roleMap_]
Note: Dont copy the entire authorize.conf as it has hashed password for binding to AD, in case you use AD integration.
The user roles are stored in Authorize.conf file. If you've any custom role created, then they should be available in $SPLUNK_HOME/etc/system/local/
OR $SPLUNK_HOME/etc/apps/
folder. Just copy the authorize.conf and restart the Splunk instance. More details here.
http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/Addandeditroleswithauthorizeconf