topic Re: Splunk reload auth in Search head Error in Splunk Enterprise

Splunk reload auth in Search head Error

Sathish28 — Wed, 12 Feb 2025 15:06:08 GMT

Recently we migrated a server from Virtual Machine to Physical server
We use LDAP authentication for user access for Splunk
The users were able to login but did not have the same privileges when moved from VM to physical server

I am able to login into Splunk Web UI but as a admin I am not able to view with admin privileges, So i tried to run the below command in the search head server

./splunk reload auth

I got the below error

Authorization Failed: b'<?xml version="1.0" encoding="UTF-8"?>\n<response>\n <messages>\n <msg type="ERROR">You (user=88888888) do not have permission to perform this operation (requires capability: change_authentication).</msg>\n </messages>\n</response>\n'
Client is not authorized to perform requested action

Re: Splunk reload auth in Search head Error

livehybrid — Wed, 12 Feb 2025 15:24:01 GMT

It looks like your user role doesnt have `change_authentication = enabled` which is required for this task.

Do you have access to an admin account, or maybe a break-glass account that you can execute the CLI reload with?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: Splunk reload auth in Search head Error

kiran_panchavat — Wed, 12 Feb 2025 15:32:23 GMT

@Sathish28

As @livehybrid said, please check this.

[capability::change_authentication]

* Lets a user change authentication settings through the authentication endpoints.
* Lets the user reload authentication.

and also,

This seems to work to reload it, and is available through the management port.

curl -k -u admin:changeme https://splunkserver:8089/services/authentication/providers/services/_reload

You can use this simple Splunk command to do this:

./splunk _internal call /authentication/providers/services/_reload -auth

 QUERYING: 'https://127.0.0.1:8089/services/authentication/providers/services/_reload'
Your session is invalid. Please login.
Splunk username: 
Password:
HTTP Status: 200.
Content:
<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>auth-services</title>
<id>https://127.0.0.1:8089/services/authentication/providers/services</id>
<updated>2014-04-02T08:39:45+02:00</updated>
<generator build="163460" version="5.0.3"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/authentication/providers/services/_reload" rel="_reload"/>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
</feed>