Security

Using LDAP authentication, can I block access to a particular user in Splunk without removing them from the AD group?

jbsplunk
Splunk Employee
Splunk Employee

I'm using LDAP authentication with my Active Directory as my authentication method for Splunk. I need to stop a particular user from accessing Splunk, but I don't have access to the AD server. Is there some method I can use on the Splunk instance to block user access?

Tags (2)
1 Solution

Chubbybunny
Splunk Employee
Splunk Employee

a User base filter would the quickest way.

For example, an AD group named SplunkSF with the following user accounts assigned: user1, user2, and user3

With this User base filter (NOT), we can prevent user3 from gaining access to Splunk: LDAP connection settings > User Settings > User base filter

(!(sAMAccountName=user3))

Or prevent user1 and user3

(&(!(sAMAccountName=user1))(!(sAMAccountName=user3)))


(\__/)
(='.'=)
(")_(")

View solution in original post

Chubbybunny
Splunk Employee
Splunk Employee

a User base filter would the quickest way.

For example, an AD group named SplunkSF with the following user accounts assigned: user1, user2, and user3

With this User base filter (NOT), we can prevent user3 from gaining access to Splunk: LDAP connection settings > User Settings > User base filter

(!(sAMAccountName=user3))

Or prevent user1 and user3

(&(!(sAMAccountName=user1))(!(sAMAccountName=user3)))


(\__/)
(='.'=)
(")_(")

Chubbybunny
Splunk Employee
Splunk Employee

perhaps a enhancement request too, I would expect a kill switch to disable or block user access.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...