topic Re: Splunk _internal call to give multiple values to a parameter in Security

Splunk _internal call to give multiple values to a parameter

premg — Thu, 13 Mar 2014 09:35:25 GMT

Hi,

I make use of _internal call to add users to the splunk as follows.
/opt/splunk/bin/splunk _internal call /services/authentication/users/ -post:name "prem" -post:password "pass" -post:roles "admin" -auth user:pwd

But here i want to assign multiple roles to an user.Is it possible to assign multiple values during user creation or append any role to the user after the user got created?If yes please help with the synatx .

Re: Splunk _internal call to give multiple values to a parameter

martin_mueller — Thu, 13 Mar 2014 12:17:43 GMT

The documentation is here: http://docs.splunk.com/Documentation/Splunk/6.0.2/RESTAPI/RESTaccess#POST_authentication.2Fusers

For the roles parameter it says "A role to assign to this user. To assign multiple roles, send them in separate roles parameters." Hence you can amend your call like this:

/opt/splunk/bin/splunk _internal call /services/authentication/users/ -post:name "prem" -post:password "pass" -post:roles "admin" -post:roles "some_role" -post:roles "another_role" -auth user:pwd

Re: Splunk _internal call to give multiple values to a parameter

jerinabeham — Mon, 28 Sep 2020 16:07:23 GMT

Many thanks.
But i have a concern here.Say now the user prem is created with 3 roles admin,some_role,another_role.Suppose if i want to assign one more new role,how the syntax would be?

Say if i do as below,the already assigned roles would be off and only role would be new_role.
/opt/splunk/bin/splunk _internalcall /services/authentication/users/prem -post:roles "new_role" -auth user:pwd

Any idea on this?

Re: Splunk _internal call to give multiple values to a parameter

martin_mueller — Thu, 13 Mar 2014 13:30:31 GMT

As per http://docs.splunk.com/Documentation/Splunk/6.0.2/RESTAPI/RESTaccess#POST_authentication.2Fusers.2F.7Bname.7D you will need to specify the entire value for the field roles, in your example like this:

./splunk _internal call /services/authentication/users/prem -post:roles "admin" -post:roles "some_role" -post:roles "another_role" -post:roles "new_role"

You're passing a new value for roles, so if the value you pass only has one entry in it then you will drop the old values. Else there would be no way to remove a role from a user.