topic Re: User Mapping in Splunk Enterprise

User Mapping

edwardrose — Mon, 15 Feb 2021 17:41:02 GMT

Hello All,

I am trying to find where a user is getting mapped to a role. I can see that the user is mapped to the power role in the webui, but I do not see the user being mapped there in /opt/splunk/etc/system/local/authentication.conf. So what am I missing? Also there is nothing in /opt/splunk/etc/apps/* that would map the user to the power role.

Thoughts?

thanks

Re: User Mapping

edwardrose — Mon, 15 Feb 2021 20:17:01 GMT

authorize.conf is used for mapping capabilities to roles

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/authorizeconf

Re: User Mapping

scelikok — Tue, 16 Feb 2021 03:36:37 GMT

Hi @edwardrose,

User role mappings are in below file;

$SPLUNK_HOME/etc/passwd

Re: User Mapping

richgalloway — Tue, 16 Feb 2021 18:40:04 GMT

~~There is no role mapping info in the passwd file, @scelikok~~

Re: User Mapping

scelikok — Tue, 16 Feb 2021 14:58:02 GMT

Hi @richgalloway,

Inside $SPLUNK_HOME/etc/passwd below bold field is user role for local Splun authentication. If user has more roles they are listed there comma separated.

:admin:password_hash::Administrator:admin:changeme@example.com:::18624

In case of LDAP authentication user -> role mapping is in authentication.conf

Re: User Mapping

richgalloway — Tue, 16 Feb 2021 18:39:02 GMT

Thanks for straightening me out, @scelikok . I ran a quick test and the mapping of user to role(s) is indeed in passwd. Authorize.conf maps the roles to capabilities and other settings.

I'll remove my erroneous answer to avoid confusion.