Security

Splunk Role Management - Disabling Roles in authorize.conf

brdr
Contributor

We are using v8.0.4 of Splunk Enterpise. In our authorize.conf I see roles are disabled. Examples:

[role_sec_power_user]
disabled = true

[role_sec_admin_user]
disabled = true

[role_idx_data_user]
disabled = true

I've looked through the spec file for authorize.conf and no where do I see the option to disable a role. Further, I don't see an option in the GUI to disable roles.

Question: Is it possible to disable a role using this syntax above?

Thanks

Labels (1)
0 Karma
1 Solution

shivanshu1593
Contributor

You cannot disable a role, but you can add or delete them. If you want to get rid of the roles completely, you can do either of the following:

1. From GUI, Under roles, click delete.

2. In authorize.conf, remove the stanza and either reload the auth from $SPLUNK_HOME/bin, using ./splunk reload auth or reload Splunkd.

 

If you want to keep the roles around, you can do this as an alternative to disable.

1. Comment/hash out the entire stanza of the role like the following and either reload the auth using the command mentioned above or restart splunkd. Hashing out tells Splunk not to read the stanza, which id equivalent to disabled in your case.

#[Your_role]
#rtsearch = enabled
#importRoles = user
#srchFilter = host=foo
#srchIndexesAllowed = *
#srchIndexesDefault = mail;main
#srchJobsQuota   = 8
#rtSrchJobsQuota = 8
#srchDiskQuota   = 500

Hope this helps,

S.

Note: If it helped, please mark it as a accepted. It helps others with the same issue to reach the solution quickly.

 

 

 

 

 

 

View solution in original post

shivanshu1593
Contributor

You cannot disable a role, but you can add or delete them. If you want to get rid of the roles completely, you can do either of the following:

1. From GUI, Under roles, click delete.

2. In authorize.conf, remove the stanza and either reload the auth from $SPLUNK_HOME/bin, using ./splunk reload auth or reload Splunkd.

 

If you want to keep the roles around, you can do this as an alternative to disable.

1. Comment/hash out the entire stanza of the role like the following and either reload the auth using the command mentioned above or restart splunkd. Hashing out tells Splunk not to read the stanza, which id equivalent to disabled in your case.

#[Your_role]
#rtsearch = enabled
#importRoles = user
#srchFilter = host=foo
#srchIndexesAllowed = *
#srchIndexesDefault = mail;main
#srchJobsQuota   = 8
#rtSrchJobsQuota = 8
#srchDiskQuota   = 500

Hope this helps,

S.

Note: If it helped, please mark it as a accepted. It helps others with the same issue to reach the solution quickly.

 

 

 

 

 

 

View solution in original post

brdr
Contributor

Perfect, thank you @shivanshu1593 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!