Security

Splunk _internal call to give multiple values to a parameter

premg
Engager

Hi,

I make use of _internal call to add users to the splunk as follows.
/opt/splunk/bin/splunk _internal call /services/authentication/users/ -post:name "prem" -post:password "pass" -post:roles "admin" -auth user:pwd

But here i want to assign multiple roles to an user.Is it possible to assign multiple values during user creation or append any role to the user after the user got created?If yes please help with the synatx .

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The documentation is here: http://docs.splunk.com/Documentation/Splunk/6.0.2/RESTAPI/RESTaccess#POST_authentication.2Fusers

For the roles parameter it says "A role to assign to this user. To assign multiple roles, send them in separate roles parameters." Hence you can amend your call like this:

/opt/splunk/bin/splunk _internal call /services/authentication/users/ -post:name "prem" -post:password "pass" -post:roles "admin" -post:roles "some_role" -post:roles "another_role" -auth user:pwd

martin_mueller
SplunkTrust
SplunkTrust

As per http://docs.splunk.com/Documentation/Splunk/6.0.2/RESTAPI/RESTaccess#POST_authentication.2Fusers.2F.... you will need to specify the entire value for the field roles, in your example like this:

./splunk _internal call /services/authentication/users/prem -post:roles "admin" -post:roles "some_role" -post:roles "another_role" -post:roles "new_role"

You're passing a new value for roles, so if the value you pass only has one entry in it then you will drop the old values. Else there would be no way to remove a role from a user.

0 Karma

jerinabeham
Explorer

Many thanks.
But i have a concern here.Say now the user prem is created with 3 roles admin,some_role,another_role.Suppose if i want to assign one more new role,how the syntax would be?

Say if i do as below,the already assigned roles would be off and only role would be new_role.
/opt/splunk/bin/splunk _internalcall /services/authentication/users/prem -post:roles "new_role" -auth user:pwd

Any idea on this?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...