Security

search head auth reload

Explorer

We are running Splunk Version 6.3 and are using LDAP to manage authentication.

We need to run "auth reload" after new users are added to LDAP group.

I'm trying to use "inputs.conf" to trigger "auth reload" on a schedule.

My question is: how do I run this command without providing auth:passwd info?

thanks!
Judy

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Here's my solution.

Use the rest command to hit this rest endpoint as an Admin user:

| rest  /services/authentication/providers/services/_reload

Save as a search, run on a schedule.

View solution in original post

SplunkTrust
SplunkTrust

Here's my solution.

Use the rest command to hit this rest endpoint as an Admin user:

| rest  /services/authentication/providers/services/_reload

Save as a search, run on a schedule.

View solution in original post

Builder

Does this work on search heads cluster?

0 Karma

Path Finder

good call, I hadn't considered running a saved search (shoulda been obvious...). deleting my answer 🙂

Explorer

thank you! it works well

Influencer

I have to admit this also sounds bizzare to me. We have been running Splunk with LDAP authentication against Active Directory domains from 6.0 (we're currently on 6.3.8), and we've never had to reload for a user being added to a group to gain access to Splunk. We have seen some delay before (if a user was added to a splunk access group on an AD server that happens to be located on the other side of the world for example, it may take a bit for that membership to propagate to the AD servers that Splunk was using). Perhaps you would be willing to share more information on your setup? authentication.conf (remove your bind password of course), and what type of LDAP server you're running against to see if other folks might have ideas on trying to get you running without needing to do auth reload for simply ldap group membership changes?

SplunkTrust
SplunkTrust

Running the reload after changes are made on the LDAP side shouldn't be necessary. I see this as working:

  1. Add user to LDAP group
  2. User logs in to Splunk
  3. User appears in the user list

Does that order not work in your environment?

Explorer

After adding users to ldap group, users won't show up in the user splunk user list, and user can't get authenticated in either. We have to run "auth reload"

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!