Security

When adding a new user to the Splunk cluster, is there a way to enforce a password change the first time a user logs in?

shivanshsingh
Explorer

I am an admin of splunk and when I add new user to the splunk cluster, I want to enforce password change for the first time user logs in. Is there a way I can enforce it?

Tags (4)
1 Solution

Damien_Dallimor
Ultra Champion

I know how to do this via the REST API.

So for example to force "someuser" to change their password :

curl -k -u admin:password https://localhost:8089/services/authentication/users/someuser -d force-change-pass=true

So you could script something up.

View solution in original post

Damien_Dallimor
Ultra Champion

I know how to do this via the REST API.

So for example to force "someuser" to change their password :

curl -k -u admin:password https://localhost:8089/services/authentication/users/someuser -d force-change-pass=true

So you could script something up.

hwakonwalk
Path Finder

Hi Damien Dallimore
I am using Spunk 6.5.2 and want to force the users to change the password. I have don't know much on how do we use REST API
Can you please provide with additional references that I can go through and make the above command work for my requirement also

Thanks,
Zubair

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Cool - I think I remembered older versions allowed the user to skip this step, but apparently 6.2.1 doesn't 🙂

0 Karma

shivanshsingh
Explorer

Awesome! This is exactly what I was looking for!!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'd recommend moving to external authentication such as LDAP or Active Directory. You get many more features thrown in that aren't built into Splunk's local user management.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...