topic User authentication to multiple AD domains in Splunk in Security

User authentication to multiple AD domains in Splunk

joberget — Tue, 29 Jun 2010 17:45:09 GMT

Is it possible to configure Splunk so that one can choose which Active Directory to login in to? For example in the login menu of Splunk web choose which AD I want to login to.

Re: User authentication to multiple AD domains in Splunk

the_wolverine — Tue, 29 Jun 2010 20:42:55 GMT

This is not currently possible, unfortunately. Other folks have asked for this feature and I believe it will come in a future release. If you're an Enterprise customer please file an ER to request it to help us gauge the interest.

Re: User authentication to multiple AD domains in Splunk

joberget — Fri, 02 Jul 2010 05:05:07 GMT

Thanks for the reply! I will fill an ER as soon as we become Enterprise customers. 🙂

Re: User authentication to multiple AD domains in Splunk

mpatnode — Fri, 20 Aug 2010 03:47:41 GMT

This could be done using another (free) product:

Install Splunk on a Linux machine
Install Centrify Express on that same machine.
Join one of the domains
Configure Splunk for PAM authentication.

Now, assuming the domains are in the same forest, or you have cross-forest trust between the domains, users can log into Splunk as windowsloginname@domain.name.

Re: User authentication to multiple AD domains in Splunk

joberget — Mon, 23 Aug 2010 15:51:52 GMT

Thanks! I will check Centrify Express out.

Re: User authentication to multiple AD domains in Splunk

Jason — Wed, 12 Mar 2014 14:37:18 GMT

This is now possible (beginning with Splunk 5 in late 2012). You can configure mutiple LDAP servers and Splunk will try each one. The current limitation seems to be that the user must be able to authenticate and be in a splunk-role-assigned group on the same LDAP server ("scheme").

http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkwithmultipleLDAPservers