topic Re: How to remove users from Splunk registered by SAML? in Security

How to remove users from Splunk registered by SAML?

Clecimar — Tue, 30 Aug 2022 15:13:23 GMT

Hi everyone, I need to remover users that leave the company. I´ve already remove them from company AD, but the remains on the Splunk Cloud.

Someone know how can I delete/remove them from Splunk Cloud ?

Thank you.

Clecimar

Re: How to remove users from Splunk registered by SAML?

richgalloway — Tue, 30 Aug 2022 16:58:04 GMT

Go to Settings->Users. For each user no longer in SAML, select Edit->Delete. There is no automated process. Go to https://ideas.splunk.com to suggest one or to vote for an existing idea.

Re: How to remove users from Splunk registered by SAML?

Clecimar — Wed, 31 Aug 2022 17:40:15 GMT

Hi everyone.

This didn´t work for me. Even I remove the user from AD, it remains on Splunk and I haven´t the option to remove it as you suggest.

Would be a integration issue ?

Thank you.

Clecimar

Re: How to remove users from Splunk registered by SAML?

richgalloway — Wed, 31 Aug 2022 19:24:12 GMT

You account may have insufficient permissions to delete users. I believe you need the edit_user capability.

Re: How to remove users from Splunk registered by SAML?

Clecimar — Sun, 04 Sep 2022 19:23:31 GMT

No, I´m administrator.

I´m going to open a case on support.

Thank you.

Clecimar

Re: How to remove users from Splunk registered by SAML?

vzabawski — Wed, 14 Sep 2022 09:23:17 GMT

GUI doesn't support deleting users created with SAML. I can edit internal users. I guess it's an expected, yet inconvenient behavior from Splunk's side.

Re: How to remove users from Splunk registered by SAML?

Clecimar — Wed, 14 Sep 2022 12:37:24 GMT

Great!

This is the kind of answer I was looking for. Thank to understand my question.

Clecimar

Re: How to remove users from Splunk registered by SAML?

dbhojani — Fri, 14 Apr 2023 17:25:51 GMT

Did you get any response from splunk support for this issue?

I am also Splunk admin & I don't see an option to remove deactivated SAML user from UI.

It's not feasible to request support request every time a user is deactivated.

Re: How to remove users from Splunk registered by SAML?

skseifert — Tue, 30 May 2023 19:29:42 GMT

I am in a role that has "edit_user" selected, and I too can not delete a SAML user.

Re: How to remove users from Splunk registered by SAML?

dbhojani — Tue, 30 May 2023 19:39:21 GMT

I was able to find solution for this.

You can delete the user with REST Call if you have Admin level access.

This worked fine for me.

curl -k -u test_user:<PWD> --request DELETE https://stackname.splunkcloud.com:8089/services/admin/SAML-user-role-map/<username>

Re: How to remove users from Splunk registered by SAML?

jmartens — Tue, 29 Oct 2024 09:58:30 GMT

Although removing through REST probably works I find it easier to do it this way:

edit the configuration file in SPLUNK_INSTALL_DIR\etc\system\local\authentication.conf
Naviate to Settings > Authentication methods > reload authentication configuration