Security

Can I set force_change_pass on a user from the command line?

Explorer

I can use the API to set this:
curl -k -u admin:changeme https://localhost:8089/services/authentication/users/test_user -d force-change-pass=true

etc/passwd:
:testuser:$6$7d9TeVeVS./Z0ojt$jAlgxrZaaAAaAaAqY11Nr1uP0q4/utf1VXsL5sIrtj7CSPRAoikExiyL.SGAy/8bfsPK7/:::user:::forcechange_pass

but on the command line there is no luck:
*splunk edit user testuser -forcechange_pass true -auth admin:changeme *

In handler 'users': Argument "forcechangepass" is not supported by this handler.

Splunk Employee
Splunk Employee

You can use Splunk's command line to do this by invoking an _internal call ...

$SPLUNK_HOME/bin/splunk _interncal call /authentication/users/test_user -post:force-change-pass "true"
0 Karma

SplunkTrust
SplunkTrust

Do like this

splunk edit user test_user -force-change-pass true -auth admin:changeme