topic How to create user who can create user without administrative right ? in Security

How to create user who can create user without administrative right ?

akanno — Mon, 28 Sep 2020 18:29:24 GMT

Hi,splunk community.

I'm now considering user management.

I want to create user who can only do user management without administrative right.
Therefore, I created a new user, and I added "edit_user" and "edit_role" to Capabilities of this user.

It looks like I created the user who do user management without administrative right.
However, this user can create user who have administrative right.
That really doesn't have any meaning.

is there a way to prevent to create user who have administrative right?

Re: How to create user who can create user without administrative right ?

martin_mueller — Mon, 22 Dec 2014 16:29:01 GMT

The best way is to outsource user management via LDAP or Active Directory. The Splunk administrator sets up the connection and maps Splunk roles to LDAP/AD groups, and users are added/removed from Splunk by adding them to those LDAP/AD groups or removing them.

With the built-in authentication you're not going to achieve that, there's no special capability that restricts assigning roles with admin permissions to users, and nothing restricting assigning admin capabilities to roles.

Re: How to create user who can create user without administrative right ?

akanno — Fri, 26 Dec 2014 02:12:41 GMT

Thank you for your help.
I will use LDAP or AD.