How to remove user roles via rest API curl commands?

[bobcatluke]

I am trying to create an automation script using Python. Part of the script needs to be able to remove roles for a specified user. I have not found any documentation about how to remove ALL user roles or even specific roles using curl commands with the rest api. There has to be a way, does anyone have any insight on how to do this? The resources that I have found only talk about adding a role to a user, or manually removing roles from a user (which defeats the purpose of automating the process).

LDAP

[bobcatluke · Accepted solution]

SOLUTION

Example (add roles user and power):

"curl -X POST -u admin:password -k https ://servername:8089/servicesNS/-/admin/LDAP-groups/endpointgoeshere%2usersnametoedit -d roles = user -d roles = power"

To remove all roles you would just leave the " -d roles = " part blank.

[harsmarvania57]

When you have LDAP authentication, you need to map LDAP group with role in Splunk.

To add/remove access for any LDAP user you need to remove that user from LDAP group, you can't remove LDAP users directly on Splunk.

[bobcatluke]

I see, I was trying to remove role via local authentication. Our org organizes the LDAP configuration file like
roleA: person1, person2, person3. roleB: person1, person5, person9. So I now I need to figure out a way to automate the removal of a instance of a users name in the configuration file. Down another rabbit hole I go.

[harsmarvania57]

Can you please provide some more information like. is it local user, LDAP , SAML .... ?

[bobcatluke]

My apologies, LDAP

[skalliger]

Did you try /services/authentication/users/ (docs page for more information)?

Skalli

[bobcatluke]

Yes, but there is nothing about removing roles from a user, only assigning a role/deleting the role itself.