search head auth reload

[judyhuang]

We are running Splunk Version 6.3 and are using LDAP to manage authentication.

We need to run "auth reload" after new users are added to LDAP group.

I'm trying to use "inputs.conf" to trigger "auth reload" on a schedule.

My question is: how do I run this command without providing auth:passwd info?

thanks!
Judy

[jkat54 · Accepted solution]

Here's my solution.

Use the rest command to hit this rest endpoint as an Admin user:

| rest  /services/authentication/providers/services/_reload

Save as a search, run on a schedule.

[splunkreal]

Does this work on search heads cluster?

[sjalexander]

good call, I hadn't considered running a saved search (shoulda been obvious...). deleting my answer 🙂

[judyhuang]

thank you! it works well

[acharlieh]

I have to admit this also sounds bizzare to me. We have been running Splunk with LDAP authentication against Active Directory domains from 6.0 (we're currently on 6.3.8), and we've never had to reload for a user being added to a group to gain access to Splunk. We have seen some delay before (if a user was added to a splunk access group on an AD server that happens to be located on the other side of the world for example, it may take a bit for that membership to propagate to the AD servers that Splunk was using). Perhaps you would be willing to share more information on your setup? authentication.conf (remove your bind password of course), and what type of LDAP server you're running against to see if other folks might have ideas on trying to get you running without needing to do auth reload for simply ldap group membership changes?

[martin_mueller]

Running the reload after changes are made on the LDAP side shouldn't be necessary. I see this as working:

1. Add user to LDAP group
2. User logs in to Splunk
3. User appears in the user list

Does that order not work in your environment?

[judyhuang]

After adding users to ldap group, users won't show up in the user splunk user list, and user can't get authenticated in either. We have to run "auth reload"