Security

Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

marco_sulla
Path Finder

I followed the instructions in this answer (and their comments too) but I can't copy the user's roles from one Splunk to another.

Where are user's roles stored? I checked the $SPLUNK_HOME/etc/users folder and it does not seem to contain such information.

Tags (3)
0 Karma
1 Solution

marco_sulla
Path Finder

I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd file. So I you have also to copy that file if you want to sync users between two Splunk instances.
To recap:
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:

  1. $SPLUNK_HOME/etc/users
  2. $SPLUNK_HOME/etc/system/local/authorize.conf (or wherever you put it)
  3. $SPLUNK_HOME/etc/passwd

View solution in original post

marco_sulla
Path Finder

I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd file. So I you have also to copy that file if you want to sync users between two Splunk instances.
To recap:
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:

  1. $SPLUNK_HOME/etc/users
  2. $SPLUNK_HOME/etc/system/local/authorize.conf (or wherever you put it)
  3. $SPLUNK_HOME/etc/passwd

View solution in original post

bohrasaurabh
Communicator

passed file is for local authentication only and not Roles and Privileges.

0 Karma

marco_sulla
Path Finder

Connection between roles and users are stored in that file. Please check.
authorize.conf does only contains roles, not connection between users and roles.

bohrasaurabh
Communicator

Also from the path "somesoni2" as mentioned, from authorize.conf you will have to copy the contents of the stanza which starts as below.

[roleMap_]

Note: Dont copy the entire authorize.conf as it has hashed password for binding to AD, in case you use AD integration.

0 Karma

somesoni2
Revered Legend

The user roles are stored in Authorize.conf file. If you've any custom role created, then they should be available in $SPLUNK_HOME/etc/system/local/ OR $SPLUNK_HOME/etc/apps/ folder. Just copy the authorize.conf and restart the Splunk instance. More details here.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/Addandeditroleswithauthorizeconf