How to remove old SAML Users in Splunk

Applicability

Description

This article highlights best practice techniques for retiring SAML users 

Investigation

SAML operates as a one-way federation standard. This means that Splunk receives information solely from the Identity Provider (IdP) during sign-in. Consequently, if a user is deleted from the IdP, Splunk will not receive the update, because that user would never sign-in again.

Prerequisite:

1.   Manage user knowledge objects (KOs)

• When a knowledge object owner leaves a department or company and their Splunk account is deactivated, the knowledge objects that they owned remain in the system. These are orphaned knowledge objects. Knowledge objects without valid owners can cause problems. For example, searches that refer to orphaned lookup definitions may not work.

2. Please follow the steps detailed in the Documentation link below, to re-assign any KOs belonging to the SAML users to be retired:

Reassign one or more shared knowledge objects to a new owner

Resolution

Be sure to re-assign any KO the user(s) to be removed have associated (see prerequisites above).

Option 1:

Remove the SAML users by modifying the .conf files via the REST API:

CURL\REST API Example:
curl -k -u admin:{password} --request DELETE https://{hostname}:8089/services/admin/SAML-user-role-map/{user_id}

Option 2:

Attach a list of the users to be removed in a Support > Splunk Cloud > Cloud Change Request ticket.

What Splunk Support does:
1. For the provided Users a backup is taken of their $SPLUNK_HOME/etc/users/<directories> and  $SPLUNK_HOME/etc/system/local/authentication.conf

2. The User home directories are removed.

3. Under the[userToRoleMap_SAML] stanza in the authentication.conf file, the lines corresponding to the retired users are deleted.

4. Perform a debug/refresh then reload the SAML configurations in Settings  >  Access Controls  >  Authentication Method  >  Reload SAML Settings at the bottom of the Web UI screen or restart the instance for the changes to take effect.

Notes: For the SAML user who never logged into the search head, there is no need to delete it by following the above solution. It can be simply removed by following Settings > Users > filter user name > Edit >Delete.

Related Links

Splunk Documentation
Resolve orphaned searches

Splunk Answers
How do i remove old saml users?