Security

Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

marco_sulla
Path Finder

I followed the instructions in this answer (and their comments too) but I can't copy the user's roles from one Splunk to another.

Where are user's roles stored? I checked the $SPLUNK_HOME/etc/users folder and it does not seem to contain such information.

Tags (3)
0 Karma
1 Solution

marco_sulla
Path Finder

I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd file. So I you have also to copy that file if you want to sync users between two Splunk instances.
To recap:
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:

  1. $SPLUNK_HOME/etc/users
  2. $SPLUNK_HOME/etc/system/local/authorize.conf (or wherever you put it)
  3. $SPLUNK_HOME/etc/passwd

View solution in original post

marco_sulla
Path Finder

I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd file. So I you have also to copy that file if you want to sync users between two Splunk instances.
To recap:
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:

  1. $SPLUNK_HOME/etc/users
  2. $SPLUNK_HOME/etc/system/local/authorize.conf (or wherever you put it)
  3. $SPLUNK_HOME/etc/passwd

bohrasaurabh
Communicator

passed file is for local authentication only and not Roles and Privileges.

0 Karma

marco_sulla
Path Finder

Connection between roles and users are stored in that file. Please check.
authorize.conf does only contains roles, not connection between users and roles.

bohrasaurabh
Communicator

Also from the path "somesoni2" as mentioned, from authorize.conf you will have to copy the contents of the stanza which starts as below.

[roleMap_]

Note: Dont copy the entire authorize.conf as it has hashed password for binding to AD, in case you use AD integration.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The user roles are stored in Authorize.conf file. If you've any custom role created, then they should be available in $SPLUNK_HOME/etc/system/local/ OR $SPLUNK_HOME/etc/apps/ folder. Just copy the authorize.conf and restart the Splunk instance. More details here.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/Addandeditroleswithauthorizeconf

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...