Security

Temporary user access

tmarlette
Motivator

I have a team of users who only need brief access to my splunk environment.

Is there a way to take either a user or a role, and apply them, say for 30 day's, and then the accounts are disabled / deleted?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I don't think there's a way to do automatic user expiry with Splunk's built-in authentication. However, with external authentication you could do this, for example by setting an account expiration date in your Active Directory linked to Splunk over LDAP. Once expired in AD the user won't be able to login to Splunk either.

As a blunt-force workaround with Splunk's built-in authentication you could give your users a name like john_doe_2014-06-01 and schedule a script to run every night on your search head, looking for users that expired based on that date and deleting them through Splunk's CLI.

For a more involved workaround with Splunk's built-in authentication you could look at when a user was created like this:

| rest /services/authentication/users | fields title | join title [search index=_audit operation=create action=edit_user | stats latest(_time) as created by object | rename object as title]

If your users are named like john_doe_30d then you could build an appropriate filter for users that have expired, and use that to delete users. That's not possible from the search bar, but should work from an alert script, custom search command, or the CLI.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I don't think there's a way to do automatic user expiry with Splunk's built-in authentication. However, with external authentication you could do this, for example by setting an account expiration date in your Active Directory linked to Splunk over LDAP. Once expired in AD the user won't be able to login to Splunk either.

As a blunt-force workaround with Splunk's built-in authentication you could give your users a name like john_doe_2014-06-01 and schedule a script to run every night on your search head, looking for users that expired based on that date and deleting them through Splunk's CLI.

For a more involved workaround with Splunk's built-in authentication you could look at when a user was created like this:

| rest /services/authentication/users | fields title | join title [search index=_audit operation=create action=edit_user | stats latest(_time) as created by object | rename object as title]

If your users are named like john_doe_30d then you could build an appropriate filter for users that have expired, and use that to delete users. That's not possible from the search bar, but should work from an alert script, custom search command, or the CLI.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...