topic Re: How to remove user roles via rest API curl commands? in Getting Data In

How to remove user roles via rest API curl commands?

bobcatluke — Thu, 20 Jun 2019 16:47:33 GMT

I am trying to create an automation script using Python. Part of the script needs to be able to remove roles for a specified user. I have not found any documentation about how to remove ALL user roles or even specific roles using curl commands with the rest api. There has to be a way, does anyone have any insight on how to do this? The resources that I have found only talk about adding a role to a user, or manually removing roles from a user (which defeats the purpose of automating the process).

LDAP

Re: How to remove user roles via rest API curl commands?

skalliger — Thu, 20 Jun 2019 20:00:11 GMT

Did you try /services/authentication/users/ (docs page for more information)?

Skalli

Re: How to remove user roles via rest API curl commands?

bobcatluke — Thu, 20 Jun 2019 21:24:06 GMT

Yes, but there is nothing about removing roles from a user, only assigning a role/deleting the role itself.

Re: How to remove user roles via rest API curl commands?

harsmarvania57 — Fri, 21 Jun 2019 08:27:39 GMT

Can you please provide some more information like. is it local user, LDAP , SAML .... ?

Re: How to remove user roles via rest API curl commands?

bobcatluke — Fri, 21 Jun 2019 14:30:19 GMT

My apologies, LDAP

Re: How to remove user roles via rest API curl commands?

harsmarvania57 — Fri, 21 Jun 2019 14:57:40 GMT

When you have LDAP authentication, you need to map LDAP group with role in Splunk.

To add/remove access for any LDAP user you need to remove that user from LDAP group, you can't remove LDAP users directly on Splunk.

Re: How to remove user roles via rest API curl commands?

bobcatluke — Fri, 21 Jun 2019 15:27:24 GMT

I see, I was trying to remove role via local authentication. Our org organizes the LDAP configuration file like
roleA: person1, person2, person3. roleB: person1, person5, person9. So I now I need to figure out a way to automate the removal of a instance of a users name in the configuration file. Down another rabbit hole I go.

Re: How to remove user roles via rest API curl commands?

bobcatluke — Wed, 26 Jun 2019 16:38:46 GMT

SOLUTION

Example (add roles user and power):

"curl -X POST -u admin:password -k https ://servername:8089/servicesNS/-/admin/LDAP-groups/endpointgoeshere%2usersnametoedit -d roles = user -d roles = power"

To remove all roles you would just leave the " -d roles = " part blank.