Splunk Enterprise

Update authentication.conf by Pushing an app From Deployer to SHC?

a1bg503461
Explorer

Hello,

I have a task with two steps 

  1. Create an app taht will increase local account password complexity from 8 chars to 18chars , push it from deployer to SHC
  2. Using REST API Calls Update local admin account password with long 18chars random generated string 

I found the file I need to update it is under : /opt/splunk/etc/system/local/authentication.conf, I can create an APP folder on deployer such as /opt/splunk/etc/shcluster/apps/EXAMPLE_PASSWORD_COMPLEXITY_APP
How do I rout that the file inside updates the file in /opt/splunk/etc/system/local/authentication.conf

And on point 2. if anyone has the API Call to update SH password for local account  I woul appreciate it .

Labels (2)
0 Karma

a1bg503461
Explorer

Sorry but we decided to take another approach using REST Api calls

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you cannot push anything from deployer to SHC's members .../etc/system/local.

The correct way it use separate app for SHC generic configurations and put those there. Then you must remove everything what has added via GUI from .../etc/system/local/authentication.conf. You could try to clean your local changes by GUI and check if those are removed from fs. If not then the last option is stop your SHC and then remove those by hand from files one by one.

When you have SHC or actually any other SH the best practices is use e.g. AD or any SAML authentication to manage your users in any corporate environments. Then you should have this kind of policies implemented already on your master IDM system.

You could change password e.g. like this https://community.splunk.com/t5/Getting-Data-In/how-to-change-user-password-using-rest-url-without-u... Just replace localhost with your SHC REST api address.

r. Ismo

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...