Security

search head auth reload

judyhuang
Explorer

We are running Splunk Version 6.3 and are using LDAP to manage authentication.

We need to run "auth reload" after new users are added to LDAP group.

I'm trying to use "inputs.conf" to trigger "auth reload" on a schedule.

My question is: how do I run this command without providing auth:passwd info?

thanks!
Judy

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Here's my solution.

Use the rest command to hit this rest endpoint as an Admin user:

| rest  /services/authentication/providers/services/_reload

Save as a search, run on a schedule.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Here's my solution.

Use the rest command to hit this rest endpoint as an Admin user:

| rest  /services/authentication/providers/services/_reload

Save as a search, run on a schedule.

splunkreal
Motivator

Does this work on search heads cluster?

* If this helps, please upvote or accept solution if it solved *
0 Karma

sjalexander
Path Finder

good call, I hadn't considered running a saved search (shoulda been obvious...). deleting my answer 🙂

judyhuang
Explorer

thank you! it works well

acharlieh
Influencer

I have to admit this also sounds bizzare to me. We have been running Splunk with LDAP authentication against Active Directory domains from 6.0 (we're currently on 6.3.8), and we've never had to reload for a user being added to a group to gain access to Splunk. We have seen some delay before (if a user was added to a splunk access group on an AD server that happens to be located on the other side of the world for example, it may take a bit for that membership to propagate to the AD servers that Splunk was using). Perhaps you would be willing to share more information on your setup? authentication.conf (remove your bind password of course), and what type of LDAP server you're running against to see if other folks might have ideas on trying to get you running without needing to do auth reload for simply ldap group membership changes?

martin_mueller
SplunkTrust
SplunkTrust

Running the reload after changes are made on the LDAP side shouldn't be necessary. I see this as working:

  1. Add user to LDAP group
  2. User logs in to Splunk
  3. User appears in the user list

Does that order not work in your environment?

judyhuang
Explorer

After adding users to ldap group, users won't show up in the user splunk user list, and user can't get authenticated in either. We have to run "auth reload"

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...