Security

search head auth reload

judyhuang
Explorer

We are running Splunk Version 6.3 and are using LDAP to manage authentication.

We need to run "auth reload" after new users are added to LDAP group.

I'm trying to use "inputs.conf" to trigger "auth reload" on a schedule.

My question is: how do I run this command without providing auth:passwd info?

thanks!
Judy

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Here's my solution.

Use the rest command to hit this rest endpoint as an Admin user:

| rest  /services/authentication/providers/services/_reload

Save as a search, run on a schedule.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Here's my solution.

Use the rest command to hit this rest endpoint as an Admin user:

| rest  /services/authentication/providers/services/_reload

Save as a search, run on a schedule.

splunkreal
Motivator

Does this work on search heads cluster?

* If this helps, please upvote or accept solution 🙂 *
0 Karma

sjalexander
Path Finder

good call, I hadn't considered running a saved search (shoulda been obvious...). deleting my answer 🙂

judyhuang
Explorer

thank you! it works well

acharlieh
Influencer

I have to admit this also sounds bizzare to me. We have been running Splunk with LDAP authentication against Active Directory domains from 6.0 (we're currently on 6.3.8), and we've never had to reload for a user being added to a group to gain access to Splunk. We have seen some delay before (if a user was added to a splunk access group on an AD server that happens to be located on the other side of the world for example, it may take a bit for that membership to propagate to the AD servers that Splunk was using). Perhaps you would be willing to share more information on your setup? authentication.conf (remove your bind password of course), and what type of LDAP server you're running against to see if other folks might have ideas on trying to get you running without needing to do auth reload for simply ldap group membership changes?

martin_mueller
SplunkTrust
SplunkTrust

Running the reload after changes are made on the LDAP side shouldn't be necessary. I see this as working:

  1. Add user to LDAP group
  2. User logs in to Splunk
  3. User appears in the user list

Does that order not work in your environment?

judyhuang
Explorer

After adding users to ldap group, users won't show up in the user splunk user list, and user can't get authenticated in either. We have to run "auth reload"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...