topic Re: How do I migrate knowledge objects from internal/local user to SAML user? in Security

How do I migrate knowledge objects from internal/local user to SAML user?

jthairu_splunk — Thu, 29 Mar 2018 14:24:49 GMT

I am looking for a little more information on how to transfer ownership of existing items (dashboards, reports, alerts, etc) owned by internal users to the new saml users?

Re: How do I migrate knowledge objects from internal/local user to SAML user?

deepashri_123 — Sat, 31 Mar 2018 06:27:23 GMT

Hey@jithairu,

Refer this accepted answer:
https://answers.splunk.com/answers/289251/how-to-change-the-ownership-of-dashboards-to-a-spe.html
https://answers.splunk.com/answers/543138/change-ownership-of-alertsearchesdashboard-if-some.html

Let me know if this helps!!

Re: How do I migrate knowledge objects from internal/local user to SAML user?

suarezry — Tue, 01 May 2018 14:47:10 GMT

Hi @deepashri, this will only work if the SAML user has logged in already.

Re: How do I migrate knowledge objects from internal/local user to SAML user?

suarezry — Tue, 01 May 2018 14:48:29 GMT

Hi @hthairu, we need some more info:

Have the SAML users already logged in? (ie. Are their accounts already in splunk)
Do you run a search head cluster or are they standalone search heads.

Re: How do I migrate knowledge objects from internal/local user to SAML user?

twinspop — Tue, 01 May 2018 14:58:33 GMT

In recent versions of Splunk you can use the re-asignment page.

Settings -> All Configurations -> Reassign Knowledge Objects

Use the menus and filter to narrow your search.

Re: How do I migrate knowledge objects from internal/local user to SAML user?

sansay — Wed, 09 May 2018 00:23:53 GMT

Unfortunately, I just discovered that,
1. There is a known bug which prevents you from seeing the macros
2. This method only works for public knowledge objects, not private if the user no longer has access.
In that case, as indicated in the doc, you will have to temporarily recreate the user.

Also note that this behavior is observed in search head clusters.

Re: How do I migrate knowledge objects from internal/local user to SAML user?

twinspop — Tue, 29 Sep 2020 19:22:58 GMT

All true statements. For this situation, I cobbled together a bash script to hit up all meta files and use sed to replace olduser with newuser, then move the olduser directory from $splunk/etc/users to a safe place for backup. You'll then need to clear search history for the user cuz for some reasons the scheduler will see that and try to auth non-existent users. Finally, restart splunk.

The search history clean:

echo removing $ORIG_OWNER from SavedSearchHistory collection cuz bug SPL-134750
for sid in splunk _internal call /servicesNS/nobody/system/storage/collections/data/SavedSearchHistory/ \ | grep $ORIG_OWNER | cut -d'"' -f 4 | xxd -plain | tr -d '\n' | sed 's/$..$/%\1/g' | sed -e 's/%0a/\n/g'
do
splunk _internal call /servicesNS/nobody/system/storage/collections/data/SavedSearchHistory/$sid -method DELETE
done

EDIT: Well that was clobbered. hopefully decipherable