Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authentication/users/"?

[pgreer_splunk]

I believe the answer to this is 'no' - but, worth asking to make sure:

Can the rest call to delete a user from Splunk be called from the search '| rest' command?

End point is documented here: http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTaccess#authentication.2Fusers.2F.7Bnam...

Of course I can get info for the user from the search:

|rest /services/authentication/users/user1

And sure I can delete a user with the command:

curl -k -u admin:changeme --request DELETE https://localhost:8089/services/authentication/users/user1

But - for a user of Splunk Cloud (not having access to the CLI or REST outside of Cloud), can the search | rest /services/authentication/users/user1 be used in some form to perform the DELETE operation?

[dominiquevocat]

Maybe this helps?
https://splunkbase.splunk.com/app/2775/

[somesoni2 · Accepted solution]

You're correct on guessing the answer. No, the rest search command only supports GET calls.

On the other notes, if you're looking for a way to be able to delete the user from search, have a look at the custom search command. You can create your own search command to call the curl command to delete user.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Aboutcustomsearchcommands
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2

[pgreer_splunk]

Thought that was the case. Thanks for confirming!

Leads me to put into place an enhancement request. For SAML authentication, there is not a way to delete a user once provisioned through a successful SAML interchange. With locally defined users, the admin role can easily remove the user through the UI, with LDAP we support the ability to have LDAP remove the user in Splunk, with SAML - nope. So once the user is defined, if the person leaves the organization they're removed from the IDP - so technically they can't log in, but their user definition sits out in Splunk (indefinitely - or until Splunk Ops/Support performs the remove from the CLI (curl command)).

[pagillar]

Just wondering if you ever got solution to remove saml users once user is disabled or left organization , as you said user is defined and it stays in splunk.

[ASierra]

This is to remove a SAML user that has left the organization. Before deleting, reassign any objects, reports, and alerts that user may have.

curl -k -u <adminaccount>:<password> --request DELETE https://<instancename>.splunkcloud.com:8089/services/admin/SAML-user-role-map/username@domain.com

[dfronck]

Thanks! This works great unless the SAML role mapping has been deleted.