Security

SAML User deletion from Search Head Cluster

ssharma09
Explorer

How do I delete SAML users from Search Head Cluster?
I tried removing from stand-alone Search Head(Dev environment) using below command, successfully did that.
curl -k -u admin:{password} --request DELETE https://{..hostname}:8089/services/admin/SAML-user-role-map/{user_id}
and then manually delted user directory from /splunk_home/etc/users/

But, when I'm running this command at SH cluster(production) it is giving me error:

curl: (7) Failed to connect to URI port 8089: connection time out

Tags (1)
0 Karma

ssharma09
Explorer

Hi Harsmarvania57,
Thanks for the prompt reply. Yes, I’ve tried that command on one of the SH cluster member and also, the management port is 8089. Still receiving error.
Thanks

0 Karma

harsmarvania57
Ultra Champion

Hi,

Have you tried to run command on one of the SHC member directly, if not then try below command? Additionally you need to check whether SHC members are running Splunk management port on 8089 or not, if they are running management port on another port then you need to use that port.

curl -k -u admin:password --request DELETE https://localhost:8089/services/admin/SAML-user-role-map/{user_id}
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...