topic Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another? in Security

Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

marco_sulla — Mon, 28 Sep 2015 12:57:30 GMT

I followed the instructions in this answer (and their comments too) but I can't copy the user's roles from one Splunk to another.

Where are user's roles stored? I checked the $SPLUNK_HOME/etc/users folder and it does not seem to contain such information.

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

somesoni2 — Mon, 28 Sep 2015 13:43:03 GMT

The user roles are stored in Authorize.conf file. If you've any custom role created, then they should be available in $SPLUNK_HOME/etc/system/local/ OR $SPLUNK_HOME/etc/apps/ folder. Just copy the authorize.conf and restart the Splunk instance. More details here.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/Addandeditroleswithauthorizeconf

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

bohrasaurabh — Mon, 28 Sep 2015 13:48:27 GMT

Also from the path "somesoni2" as mentioned, from authorize.conf you will have to copy the contents of the stanza which starts as below.

[roleMap_]

Note: Dont copy the entire authorize.conf as it has hashed password for binding to AD, in case you use AD integration.

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

marco_sulla — Mon, 28 Sep 2015 13:53:48 GMT

I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd file. So I you have also to copy that file if you want to sync users between two Splunk instances.
To recap:
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:

$SPLUNK_HOME/etc/users
$SPLUNK_HOME/etc/system/local/authorize.conf (or wherever you put it)
$SPLUNK_HOME/etc/passwd

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

bohrasaurabh — Mon, 28 Sep 2015 14:11:07 GMT

passed file is for local authentication only and not Roles and Privileges.

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

marco_sulla — Mon, 28 Sep 2015 14:51:29 GMT

Connection between roles and users are stored in that file. Please check.
authorize.conf does only contains roles, not connection between users and roles.