Has anyone ever reassigned SOAR objects between users?

[victor_menezes]

Hi folks,

I'm evaluating a situation related to enabling SAML auth on SOAR but earlier I was using local accounts. Because of that, objects like assets, playbooks, etc are currently tied to the local user ids, and SAML users have different user ids. I'm looking for ideas on how to update that ownership from local to SAML new user id in order to have the users still owning those objects after changing their login type.

Or, another option but that will be unlikely to be something doable, but if I could have the SAML login to use the same user id as the local (like one replace the other) would also be interesting to explore.

[phanTom]

@victor_menezes the way I would do this is to use REST. 

1. Go to /rest/ph_user and filter for the user ids of the old and new user
2. Find all "items" owned by the old user in the relevant REST endpoint
3. Write a custom function / code block to loop through the found items and update the user id value via POST

REST Docs: https://docs.splunk.com/Documentation/SOARonprem/5.5.0/PlatformAPI/Using 

Use the phantom.requests() for local REST Calls: https://docs.splunk.com/Documentation/SOARonprem/5.5.0/PlaybookAPI/SessionAPI 

-- Hope this helped? If so please mark as a solution. Happy SOARing! --