Security
Highlighted

Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

Path Finder

I followed the instructions in this answer (and their comments too) but I can't copy the user's roles from one Splunk to another.

Where are user's roles stored? I checked the $SPLUNK_HOME/etc/users folder and it does not seem to contain such information.

Tags (3)
0 Karma
Highlighted

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

SplunkTrust
SplunkTrust

The user roles are stored in Authorize.conf file. If you've any custom role created, then they should be available in $SPLUNK_HOME/etc/system/local/ OR $SPLUNK_HOME/etc/apps/ folder. Just copy the authorize.conf and restart the Splunk instance. More details here.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/Addandeditroleswithauthorizeconf

Highlighted

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

Communicator

Also from the path "somesoni2" as mentioned, from authorize.conf you will have to copy the contents of the stanza which starts as below.

[roleMap_]

Note: Dont copy the entire authorize.conf as it has hashed password for binding to AD, in case you use AD integration.

0 Karma
Highlighted

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

Path Finder

I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd file. So I you have also to copy that file if you want to sync users between two Splunk instances.
To recap:
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:

  1. $SPLUNK_HOME/etc/users
  2. $SPLUNK_HOME/etc/system/local/authorize.conf (or wherever you put it)
  3. $SPLUNK_HOME/etc/passwd

View solution in original post

Highlighted

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

Communicator

passed file is for local authentication only and not Roles and Privileges.

0 Karma
Highlighted

Re: Where are users' roles stored, or how can I copy users' roles from one Splunk instance to another?

Path Finder

Connection between roles and users are stored in that file. Please check.
authorize.conf does only contains roles, not connection between users and roles.