User Mapping

[edwardrose]

Hello All,

I am trying to find where a user is getting mapped to a role.  I can see that the user is mapped to the power role in the webui, but I do not see the user being mapped there in /opt/splunk/etc/system/local/authentication.conf.  So what am I missing?  Also there is nothing in /opt/splunk/etc/apps/* that would map the user to the power role.  

Thoughts?

thanks

ed

[scelikok]

Hi @edwardrose,

User role mappings are in below file;

$SPLUNK_HOME/etc/passwd

[richgalloway]

There is no role mapping info in the passwd file, @scelikok 

[scelikok]

Hi @richgalloway,

Inside $SPLUNK_HOME/etc/passwd below bold field is user role for local Splun authentication. If user has more roles they are listed there comma separated.

:admin:password_hash::Administrator:admin:[email protected]:::18624

In case of LDAP authentication user -> role mapping is in authentication.conf

[richgalloway]

Thanks for straightening me out, @scelikok .  I ran a quick test and the mapping of user to role(s) is indeed in passwd.  Authorize.conf maps the roles to capabilities and other settings.

I'll remove my erroneous answer to avoid confusion.

[edwardrose]

authorize.conf is used for mapping capabilities to roles

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/authorizeconf