How to remove users from Splunk registered by SAML?

[Clecimar]

Hi everyone, I need to remover users that leave the company. I´ve already remove them from company AD, but the remains on the Splunk Cloud.

Someone know how can I delete/remove them from Splunk Cloud ?

Thank you.

Clecimar

[richgalloway]

Go to Settings->Users.  For each user no longer in SAML, select Edit->Delete.  There is no automated process.  Go to https://ideas.splunk.com to suggest one or to vote for an existing idea.

[Clecimar]

Hi everyone.

This didn´t work for me. Even I remove the user from AD, it remains on Splunk and I haven´t the option to remove it as you suggest.

Would be a integration issue ?

Thank you.

Clecimar

[richgalloway]

You account may have insufficient permissions to delete users.  I believe you need the edit_user capability.

[skseifert]

I am in a role that has "edit_user" selected, and I too can not delete a SAML user.  

[dbhojani]

I was able to find solution for this.

You can delete the user with REST Call if you have Admin level access.

This worked fine for me.

curl -k -u test_user:<PWD> --request DELETE https://stackname.splunkcloud.com:8089/services/admin/SAML-user-role-map/<username>

[jmartens]

Although removing through REST probably works I find it easier to do it this way:

1. edit the configuration file in SPLUNK_INSTALL_DIR\etc\system\local\authentication.conf
2. Naviate to Settings > Authentication methods > reload authentication configuration

[vzabawski · Accepted solution]

GUI doesn't support deleting users created with SAML. I can edit internal users. I guess it's an expected, yet inconvenient behavior from Splunk's side.

[Clecimar]

Great!

This is the kind of answer I was looking for. Thank to understand my question.

Clecimar

[Clecimar]

No, I´m administrator.

I´m going to open a case on support.

Thank you.

Clecimar

[dbhojani]

Did you get any response from splunk support for this issue?

I am also Splunk admin & I don't see an option to remove deactivated SAML user from UI. 

It's not feasible to request support request every time a user is deactivated.