Security

Why is a Radius user who we've eliminated still visible in Splunk Enterprise?

luis290311
Explorer

A user called "seguridad" created in Radius but already eliminated is still visible in Splunk console (see images below). Initially the customer was in Splunk 6.3. We upgraded, first to 6.5 and finally to Splunk 7.1.2, but the issue persists. Also, the folder of this user was eliminated from path $HOME/splunk/etc/users. Any idea of what else is missing to eliminate this user?
alt text

0 Karma

luis290311
Explorer

alt text

0 Karma

deepashri_123
Motivator

Hey@luis290311,

If you remove or modify the group or user , you need to tell Splunk to reload the authentication using either this REST call
| rest splunk_server=* /services/authentication/providers/services/_reload

or this CLI Splunk command

 ./splunk _internal call /authentication/providers/services/_reload -auth

Let me know if this helps!!

luis290311
Explorer

Thanks for colaborating, deepashri_123. Customer tested the splunk_internal command but he says the user is still there. Below I'm attaching a picture with the output of the command.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!