Security

How Do I Remove Old SAML Users?

brreeves_splunk
Splunk Employee
Splunk Employee

I originally configured my SAML authentication with a NameID that was a GUID. We noticed that they were randomly generated rather than assigned to the same user every time. We've since gone back to our IdP and changed our NameID to email address so that it stays the same each time.

How do I get rid of the extra users under Settings > Access Controls > Users?

0 Karma
1 Solution

djung
Splunk Employee
Splunk Employee

To get rid of the users in SAML please follow the directions below.

First
remove the users from ~SPLUNK_HOME/etc/users

Second
Find the correct authentication.conf (most of the time it is located under ~SPLUNK_HOME/etc/system/local)

Third,
Locate the [userToRoleMap_SAML] stanza and delete the users you want to delete in SAML.

Fourth,
Preform a debug/refresh then reload the SAML configurations in Settings > Access Controls > Authentication Method > Reload SAML Settings at the bottom of your screen.

View solution in original post

BenBurrows
Explorer

You can do what you need via rest with no need to reload the config.

curl -k -u admin:{password} --request DELETE https://{hostname}:8089/services/admin/SAML-user-role-map/{user_id}

You will need to remove the user directory on disk manually.

dbhojani
Explorer

Worked for me! This is great solution , specially for cloud customers.

0 Karma

ssharma09
Explorer

Hi BenBurrows,

curl command works fine to delete any user from stand alone SH but does not work in SH Cluster environment. It gives error when I tried at one of the SH cluster

curl: (7) Failed to connect to URI port 8089: connection time out

0 Karma

markbarber21
Path Finder

Worked great for me! This is also Splunk Cloud friendly, as we do not have access to the configuration directly.

BenBurrows
Explorer

Hi ssharma09,
I was fairly confident that would work fine but I checked it just now to be sure and it does work fine in a SH Cluster. I double checked and it happens that I ran it against the Cluster Captain but I don't think that is a requirement.

The error you posted leads me to believe there is some other issue for you. The error looks like a connection/network error rather than a splunk issue. Are you running the management service on that port on your SHC and are any firewalls blocking the connection? Does a connection get established if you try using telnet or netcat ?

Ben

0 Karma

djung
Splunk Employee
Splunk Employee

To get rid of the users in SAML please follow the directions below.

First
remove the users from ~SPLUNK_HOME/etc/users

Second
Find the correct authentication.conf (most of the time it is located under ~SPLUNK_HOME/etc/system/local)

Third,
Locate the [userToRoleMap_SAML] stanza and delete the users you want to delete in SAML.

Fourth,
Preform a debug/refresh then reload the SAML configurations in Settings > Access Controls > Authentication Method > Reload SAML Settings at the bottom of your screen.

thambisetty
SplunkTrust
SplunkTrust

Issue still persists in Splunk enterprise. I don't know why Splunk din't fix the issue yet. However, the answer is still valid. 

————————————
If this helps, give a like below.
0 Karma

sarah115
Engager

Does this process also apply to Splunk Cloud? That is, must I file a support ticket to get SAML users removed?

0 Karma

ashutosh2020
Explorer

This was a lot helpful, now i understood how this mechanism works.

0 Karma

brreeves_splunk
Splunk Employee
Splunk Employee

Yes @sarah115. You'd have to submit a ticket to Splunk Cloud Support to have this done.

  1. Reassign Knowledge Objects http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Resolveorphanedsearches#Use_the_Reassign...
  2. Compile a list of users you want to have removed, and submit them in a support ticket with a link to think answers post for clarity on what you want done. 🙂
  3. Enjoy your weekend.

sarah115
Engager

Thank you very much!

Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...