Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

[marco_sulla]

I followed the instructions in this answer (and their comments too) but I can't copy the user's roles from one Splunk to another.

Where are user's roles stored? I checked the $SPLUNK_HOME/etc/users folder and it does not seem to contain such information.

[marco_sulla · Accepted solution]

I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd file. So I you have also to copy that file if you want to sync users between two Splunk instances.
To recap:
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:

1. $SPLUNK_HOME/etc/users
2. $SPLUNK_HOME/etc/system/local/authorize.conf (or wherever you put it)
3. $SPLUNK_HOME/etc/passwd

[bohrasaurabh]

passed file is for local authentication only and not Roles and Privileges.

[marco_sulla]

Connection between roles and users are stored in that file. Please check.
authorize.conf does only contains roles, not connection between users and roles.

[bohrasaurabh]

Also from the path "somesoni2" as mentioned, from authorize.conf you will have to copy the contents of the stanza which starts as below.

[roleMap_]

Note: Dont copy the entire authorize.conf as it has hashed password for binding to AD, in case you use AD integration.

[somesoni2]

The user roles are stored in Authorize.conf file. If you've any custom role created, then they should be available in $SPLUNK_HOME/etc/system/local/ OR $SPLUNK_HOME/etc/apps/ folder. Just copy the authorize.conf and restart the Splunk instance. More details here.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/Addandeditroleswithauthorizeconf