Security

Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authentication/users/"?

pgreer_splunk
Splunk Employee
Splunk Employee

I believe the answer to this is 'no' - but, worth asking to make sure:

Can the rest call to delete a user from Splunk be called from the search '| rest' command?

End point is documented here: http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTaccess#authentication.2Fusers.2F.7Bnam...

Of course I can get info for the user from the search:

|rest /services/authentication/users/user1

And sure I can delete a user with the command:

curl -k -u admin:changeme --request DELETE https://localhost:8089/services/authentication/users/user1

But - for a user of Splunk Cloud (not having access to the CLI or REST outside of Cloud), can the search | rest /services/authentication/users/user1 be used in some form to perform the DELETE operation?

1 Solution

somesoni2
SplunkTrust
SplunkTrust

You're correct on guessing the answer. No, the rest search command only supports GET calls.

On the other notes, if you're looking for a way to be able to delete the user from search, have a look at the custom search command. You can create your own search command to call the curl command to delete user.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Aboutcustomsearchcommands
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2

View solution in original post

dominiquevocat
Motivator
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You're correct on guessing the answer. No, the rest search command only supports GET calls.

On the other notes, if you're looking for a way to be able to delete the user from search, have a look at the custom search command. You can create your own search command to call the curl command to delete user.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Aboutcustomsearchcommands
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2

pgreer_splunk
Splunk Employee
Splunk Employee

Thought that was the case. Thanks for confirming!

Leads me to put into place an enhancement request. For SAML authentication, there is not a way to delete a user once provisioned through a successful SAML interchange. With locally defined users, the admin role can easily remove the user through the UI, with LDAP we support the ability to have LDAP remove the user in Splunk, with SAML - nope. So once the user is defined, if the person leaves the organization they're removed from the IDP - so technically they can't log in, but their user definition sits out in Splunk (indefinitely - or until Splunk Ops/Support performs the remove from the CLI (curl command)).

0 Karma

pagillar
Explorer

Just wondering if you ever got solution to remove saml users once user is disabled or left organization , as you said user is defined and it stays in splunk.

0 Karma

ASierra
Explorer

This is to remove a SAML user that has left the organization. Before deleting, reassign any objects, reports, and alerts that user may have.

 

curl -k -u <adminaccount>:<password> --request DELETE https://<instancename>.splunkcloud.com:8089/services/admin/SAML-user-role-map/username@domain.com

dfronck
Communicator

Thanks! This works great unless the SAML role mapping has been deleted.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...