Migrate Splunk users from LDAP to SSO

migrate-to-sso.sh

#!/bin/bash

splunk_home=/opt/splunk/etc
my_users=$splunk_home/apps/my_domain/lookups/my_users.csv
users=$splunk_home/users
authfile=$splunk_home/new-auths.txt

# Clear the auth file
: > $authfile

csvcut -c sAMAccountName,userPrincipalName $my_users | while IFS=,  read username mail
do
	# lowercase the username
	sAMAccountName=${username,,}
	# check if user exists
	if [[ -d "$users/$sAMAccountName" && $mail != *".local" ]] ; then
		# move $sAMAccountName to $mail
		echo Moving $users/$sAMAccountName to $users/$mail
		mv $users/$sAMAccountName $users/$mail
		# Check if the user exists in any meta files
		for meta in $(grep -rl $sAMAccountName $splunk_home | egrep '\.meta$') ; do 
			echo "In $meta, changing owner from $sAMAccountName to $mail"
			sed -i "s/$sAMAccountName/$mail/g" $meta
			echo "$mail = user" >> $authfile
		done
	fi
done

cat $authfile | uniq > "uniq-$authfile"

@sanatani806

1. We did not add the users to authentication.conf. This could have caused the issue with the orphaned knowledge object for us, but after a user logs in they're mapped to the roles in there. We mapped groups to our Splunk roles and then the users get mapped to the correct roles based on group membership.

2. We did restart the Splunk instances after running the script.

@Hodgegoblin @oxo42 @sanatani806 Thanks for the script and discussion above. I am doing LDAP to SAML migration and was testing this script on our dev server but when I have executed the script and tried to restart Splunk service got below in splunkd.log and then Splunk service does not start. have executed the script when splunk was in running sate. did you come across this similar issue?

INFO ConfigWatcher [83579 SplunkConfigChangeWatcherThread] - File deleted while splunkd was not running path=/opt/splunk/etc/users/[email protected]\r/corp_digital_TA_css/local/ui-prefs.conf DELETED

also directories moved from user1 to [email protected] created like below with "?" at the end. I have checked the csv lookup and I dont see any extra character in email field .

drwx------. 14 splunk splunk 278 Nov 29 13:46 [email protected]?
drwx------. 5 splunk splunk 78 Nov 29 13:46 [email protected]?
drwx------. 9 splunk splunk 166 Nov 29 13:46 [email protected]?

@Hodgegoblin @sanatani806 @oxo42 is anyone of you actively checking this post

I am getting below error and not sure exactly how i can get rid of it. only thing for now i am doing is instead of doing mv and using cp to copy users directories.

INFO ConfigWatcher [83579 SplunkConfigChangeWatcherThread] - File deleted while splunkd was not running path=/opt/splunk/etc/users/[email protected]\r/corp_digital_TA_css/local/ui-prefs.conf DELETED