I'm using LDAP authentication with my Active Directory as my authentication method for Splunk. I need to stop a particular user from accessing Splunk, but I don't have access to the AD server. Is there some method I can use on the Splunk instance to block user access?
a User base filter would the quickest way.
For example, an AD group named SplunkSF with the following user accounts assigned: user1, user2, and user3
With this User base filter (NOT), we can prevent user3 from gaining access to Splunk: LDAP connection settings > User Settings > User base filter
(!(sAMAccountName=user3))
Or prevent user1 and user3
(&(!(sAMAccountName=user1))(!(sAMAccountName=user3)))
(\__/)
(='.'=)
(")_(")
a User base filter would the quickest way.
For example, an AD group named SplunkSF with the following user accounts assigned: user1, user2, and user3
With this User base filter (NOT), we can prevent user3 from gaining access to Splunk: LDAP connection settings > User Settings > User base filter
(!(sAMAccountName=user3))
Or prevent user1 and user3
(&(!(sAMAccountName=user1))(!(sAMAccountName=user3)))
(\__/)
(='.'=)
(")_(")
perhaps a enhancement request too, I would expect a kill switch to disable or block user access.