I am trying to create an automation script using Python. Part of the script needs to be able to remove roles for a specified user. I have not found any documentation about how to remove ALL user roles or even specific roles using curl commands with the rest api. There has to be a way, does anyone have any insight on how to do this? The resources that I have found only talk about adding a role to a user, or manually removing roles from a user (which defeats the purpose of automating the process).
Yes, but there is nothing about removing roles from a user, only assigning a role/deleting the role itself.
When you have LDAP authentication, you need to map LDAP group with role in Splunk.
To add/remove access for any LDAP user you need to remove that user from LDAP group, you can't remove LDAP users directly on Splunk.
I see, I was trying to remove role via local authentication. Our org organizes the LDAP configuration file like
roleA: person1, person2, person3. roleB: person1, person5, person9. So I now I need to figure out a way to automate the removal of a instance of a users name in the configuration file. Down another rabbit hole I go.
Example (add roles user and power):
"curl -X POST -u admin:password -k https ://servername:8089/servicesNS/-/admin/LDAP-groups/endpointgoeshere%2usersnametoedit -d roles = user -d roles = power"
To remove all roles you would just leave the " -d roles = " part blank.