topic Re: Using LDAP authentication, can I block access to a particular user in Splunk without removing them from the AD group? in Security

Using LDAP authentication, can I block access to a particular user in Splunk without removing them from the AD group?

jbsplunk — Tue, 14 Jan 2014 18:58:08 GMT

I'm using LDAP authentication with my Active Directory as my authentication method for Splunk. I need to stop a particular user from accessing Splunk, but I don't have access to the AD server. Is there some method I can use on the Splunk instance to block user access?

Re: Using LDAP authentication, can I block access to a particular user in Splunk without removing them from the AD group?

Chubbybunny — Tue, 14 Jan 2014 19:04:29 GMT

a User base filter would the quickest way.

For example, an AD group named SplunkSF with the following user accounts assigned: user1, user2, and user3

With this User base filter (NOT), we can prevent user3 from gaining access to Splunk: LDAP connection settings > User Settings > User base filter

(!(sAMAccountName=user3))

Or prevent user1 and user3

(&(!(sAMAccountName=user1))(!(sAMAccountName=user3)))


(\__/)
(='.'=)
(")_(")

Re: Using LDAP authentication, can I block access to a particular user in Splunk without removing them from the AD group?

Chubbybunny — Tue, 14 Jan 2014 19:46:43 GMT

perhaps a enhancement request too, I would expect a kill switch to disable or block user access.