Security

Splunk Role Management - Disabling Roles in authorize.conf

brdr
Contributor

We are using v8.0.4 of Splunk Enterpise. In our authorize.conf I see roles are disabled. Examples:

[role_sec_power_user]
disabled = true

[role_sec_admin_user]
disabled = true

[role_idx_data_user]
disabled = true

I've looked through the spec file for authorize.conf and no where do I see the option to disable a role. Further, I don't see an option in the GUI to disable roles.

Question: Is it possible to disable a role using this syntax above?

Thanks

Labels (1)
0 Karma
1 Solution

shivanshu1593
Builder

You cannot disable a role, but you can add or delete them. If you want to get rid of the roles completely, you can do either of the following:

1. From GUI, Under roles, click delete.

2. In authorize.conf, remove the stanza and either reload the auth from $SPLUNK_HOME/bin, using ./splunk reload auth or reload Splunkd.

 

If you want to keep the roles around, you can do this as an alternative to disable.

1. Comment/hash out the entire stanza of the role like the following and either reload the auth using the command mentioned above or restart splunkd. Hashing out tells Splunk not to read the stanza, which id equivalent to disabled in your case.

#[Your_role]
#rtsearch = enabled
#importRoles = user
#srchFilter = host=foo
#srchIndexesAllowed = *
#srchIndexesDefault = mail;main
#srchJobsQuota   = 8
#rtSrchJobsQuota = 8
#srchDiskQuota   = 500

Hope this helps,

S.

Note: If it helped, please mark it as a accepted. It helps others with the same issue to reach the solution quickly.

 

 

 

 

 

 

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###

View solution in original post

shivanshu1593
Builder

You cannot disable a role, but you can add or delete them. If you want to get rid of the roles completely, you can do either of the following:

1. From GUI, Under roles, click delete.

2. In authorize.conf, remove the stanza and either reload the auth from $SPLUNK_HOME/bin, using ./splunk reload auth or reload Splunkd.

 

If you want to keep the roles around, you can do this as an alternative to disable.

1. Comment/hash out the entire stanza of the role like the following and either reload the auth using the command mentioned above or restart splunkd. Hashing out tells Splunk not to read the stanza, which id equivalent to disabled in your case.

#[Your_role]
#rtsearch = enabled
#importRoles = user
#srchFilter = host=foo
#srchIndexesAllowed = *
#srchIndexesDefault = mail;main
#srchJobsQuota   = 8
#rtSrchJobsQuota = 8
#srchDiskQuota   = 500

Hope this helps,

S.

Note: If it helped, please mark it as a accepted. It helps others with the same issue to reach the solution quickly.

 

 

 

 

 

 

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###

brdr
Contributor

Perfect, thank you @shivanshu1593 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...