topic Re: Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authenticatio in Security

Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authentication/users/"?

pgreer_splunk — Mon, 18 Jul 2016 16:52:53 GMT

I believe the answer to this is 'no' - but, worth asking to make sure:

Can the rest call to delete a user from Splunk be called from the search '| rest' command?

End point is documented here: http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTaccess#authentication.2Fusers.2F.7Bname.7D

Of course I can get info for the user from the search:

|rest /services/authentication/users/user1

And sure I can delete a user with the command:

curl -k -u admin:changeme --request DELETE https://localhost:8089/services/authentication/users/user1

But - for a user of Splunk Cloud (not having access to the CLI or REST outside of Cloud), can the search | rest /services/authentication/users/user1 be used in some form to perform the DELETE operation?

Re: Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authentication/users/"?

somesoni2 — Mon, 18 Jul 2016 18:01:32 GMT

You're correct on guessing the answer. No, the rest search command only supports GET calls.

On the other notes, if you're looking for a way to be able to delete the user from search, have a look at the custom search command. You can create your own search command to call the curl command to delete user.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Aboutcustomsearchcommands
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2

Re: Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authentication/users/"?

pgreer_splunk — Mon, 18 Jul 2016 21:45:41 GMT

Thought that was the case. Thanks for confirming!

Leads me to put into place an enhancement request. For SAML authentication, there is not a way to delete a user once provisioned through a successful SAML interchange. With locally defined users, the admin role can easily remove the user through the UI, with LDAP we support the ability to have LDAP remove the user in Splunk, with SAML - nope. So once the user is defined, if the person leaves the organization they're removed from the IDP - so technically they can't log in, but their user definition sits out in Splunk (indefinitely - or until Splunk Ops/Support performs the remove from the CLI (curl command)).

Re: Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authentication/users/"?

dominiquevocat — Thu, 03 Aug 2017 14:33:48 GMT

Maybe this helps?
https://splunkbase.splunk.com/app/2775/

Re: Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authenticatio

pagillar — Tue, 15 Nov 2022 15:07:54 GMT

Just wondering if you ever got solution to remove saml users once user is disabled or left organization , as you said user is defined and it stays in splunk.

Re: Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authenticatio

ASierra — Fri, 23 Dec 2022 13:39:38 GMT

This is to remove a SAML user that has left the organization. Before deleting, reassign any objects, reports, and alerts that user may have.

curl -k -u <adminaccount>:<password> --request DELETE https://<instancename>.splunkcloud.com:8089/services/admin/SAML-user-role-map/username@domain.com

Re: Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authenticatio

dfronck — Thu, 31 Aug 2023 20:20:26 GMT

Thanks! This works great unless the SAML role mapping has been deleted.