Security
Highlighted

Admin cannot change users' roles

Explorer

Under Splunk>Manager>>Access controls>>Users, I cannot assign/remove roles from the "Available roles" and "Selected roles" lists; all of the roles in both sections are greyed out and do not respond to clicks. The users are mapped to Splunk via LDAP and I've remapped groups multiple times.

I have repeatedly verified I am an admin user.

Tags (1)
Highlighted

Re: Admin cannot change users' roles

Champion

I'm not very familiar with using LDAP authentication in Splunk but I am familiar with using scripted authentication which is similar. With scripted authentication, the roles are expected to be provided by the authentication script and thus the roles editor is disabled in the manager. I suspect this is the same issue you are seeing here.

I opened an enhancement request asking for the ability to override the automatically defined roles. You may want to do the same.

0 Karma
Highlighted

Re: Admin cannot change users' roles

Builder

Does anyone have an answer for this one? I'm having the same issue with LDAP.

0 Karma
Highlighted

Re: Admin cannot change users' roles

SplunkTrust
SplunkTrust

When you have configured authentication using LDAP, you can't modify User from Manager » Access controls » Users (role association). You would have to update the role association to the LDAP group (instead of user within the group) using LDAP strategies. See below documentation for steps:

http://docs.splunk.com/Documentation/Splunk/latest/Security/MapLDAPgroupstoSplunkroles

Other options is using authentication.conf file update.
http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureLDAPwithconfigurationfiles

Highlighted

Re: Admin cannot change users' roles

Motivator

Had the same problem except nothing was greyed out, but instead whenever I removed a role from a LDAP user it would just revert back to having that role. Ended up deleting the role from the [rolemap_mycompany] stanza in authentication.conf in system/local and rebooted (not sure if needed) and that worked.

0 Karma