topic Re: Removed users from LDAP authentication but didn't remove them from Splunk users in Security

Removed users from LDAP authentication but didn't remove them from Splunk users

katzr — Fri, 15 Sep 2017 20:19:22 GMT

Hello,

I see that there is documentation on this topic, but it is very unclear how it should be operating. So I am using LDAP authentication for Splunk and I removed a large group of users from my LDAP authentication step on a seperate application. However, this didn't remove the users from my list of splunk users. So I removed one specific user's folder in splunk/etc/users and the user is still not removed the splunk user list in UI. How should all of this functionality be working?

If I remove the user from my LDAP authentication on my seperate app- will that user not be able to log in? Even though they are still listed a splunk user in my Access Controls- User list on the web?

Thanks for the help!

Re: Removed users from LDAP authentication but didn't remove them from Splunk users

ddrillic — Sat, 16 Sep 2017 11:39:29 GMT

-- So I am using LDAP authentication for Splunk and I removed a large group of users from my LDAP authentication step on a separate application.

What does it mean?

Re: Removed users from LDAP authentication but didn't remove them from Splunk users

bsuresh1 — Sun, 17 Sep 2017 17:44:36 GMT

I am assuming that you have removed a group from AD Users and computers. If so, try Load authentication in Splunk GUI on specific Search Head. It will remove the users from Splunk.

Re: Removed users from LDAP authentication but didn't remove them from Splunk users

MuS — Mon, 18 Sep 2017 00:25:30 GMT

Hi katzr,

If you remove or modify the group or user on the LDAP provider, you need to tell Splunk to reload the authentication using either this REST call

 | rest splunk_server=* /services/authentication/providers/services/_reload

or this CLI Splunk command

./splunk _internal call /authentication/providers/services/_reload -auth

This will refresh/reload the LDAP provider information and your removed users/group should be gone.
If the users/group is still visible, check with non-Splunk LDAP tools against the LDAP provider and see what you actually get back.

Hope this helps ...

cheers, MuS

Re: Removed users from LDAP authentication but didn't remove them from Splunk users

brreeves_splunk — Mon, 18 Sep 2017 00:34:58 GMT

Here's a docs article on that exact topic:

https://docs.splunk.com/Documentation/Splunk/6.6.3/Security/BestpracticeforremovinganLDAPuser