Security

Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authentication/users/"?

pgreer_splunk
Splunk Employee
Splunk Employee

I believe the answer to this is 'no' - but, worth asking to make sure:

Can the rest call to delete a user from Splunk be called from the search '| rest' command?

End point is documented here: http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTaccess#authentication.2Fusers.2F.7Bnam...

Of course I can get info for the user from the search:

|rest /services/authentication/users/user1

And sure I can delete a user with the command:

curl -k -u admin:changeme --request DELETE https://localhost:8089/services/authentication/users/user1

But - for a user of Splunk Cloud (not having access to the CLI or REST outside of Cloud), can the search | rest /services/authentication/users/user1 be used in some form to perform the DELETE operation?

1 Solution

somesoni2
Revered Legend

You're correct on guessing the answer. No, the rest search command only supports GET calls.

On the other notes, if you're looking for a way to be able to delete the user from search, have a look at the custom search command. You can create your own search command to call the curl command to delete user.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Aboutcustomsearchcommands
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2

View solution in original post

dominiquevocat
Motivator
0 Karma

somesoni2
Revered Legend

You're correct on guessing the answer. No, the rest search command only supports GET calls.

On the other notes, if you're looking for a way to be able to delete the user from search, have a look at the custom search command. You can create your own search command to call the curl command to delete user.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Aboutcustomsearchcommands
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2

pgreer_splunk
Splunk Employee
Splunk Employee

Thought that was the case. Thanks for confirming!

Leads me to put into place an enhancement request. For SAML authentication, there is not a way to delete a user once provisioned through a successful SAML interchange. With locally defined users, the admin role can easily remove the user through the UI, with LDAP we support the ability to have LDAP remove the user in Splunk, with SAML - nope. So once the user is defined, if the person leaves the organization they're removed from the IDP - so technically they can't log in, but their user definition sits out in Splunk (indefinitely - or until Splunk Ops/Support performs the remove from the CLI (curl command)).

0 Karma

pagillar
Explorer

Just wondering if you ever got solution to remove saml users once user is disabled or left organization , as you said user is defined and it stays in splunk.

0 Karma

ASierra
Explorer

This is to remove a SAML user that has left the organization. Before deleting, reassign any objects, reports, and alerts that user may have.

 

curl -k -u <adminaccount>:<password> --request DELETE https://<instancename>.splunkcloud.com:8089/services/admin/SAML-user-role-map/username@domain.com

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...