topic How to configure Splunk to authenticate through LDAP? in Security

How to configure Splunk to authenticate through LDAP?

msg64 — Tue, 13 Jun 2017 21:08:56 GMT

I am very new to Splunk. I am looking for a simplified document to help me configure Splunk to authenticate through LDAP. Is there such a document?

Re: How to configure Splunk to authenticate through LDAP?

micahkemp — Wed, 14 Jun 2017 14:04:27 GMT

Have you checked out the existing Splunk documentation for this?

http://docs.splunk.com/Documentation/Splunk/6.6.1/Security/SetupuserauthenticationwithLDAP

Re: How to configure Splunk to authenticate through LDAP?

eagle4splunk — Wed, 14 Jun 2017 19:48:34 GMT

Here are the basic steps if you are doing this from the UI (you can also go to the CLI and update authentication.conf):

From your search head, go to Settings > Access Controls > Authentication Method
Select LDAP and click on Configure Splunk to use LDAP
Click New, populate the required fields on the form and save.

If the connection to your LDAP host works, your strategy will be saved and you can then click on "Map Groups" to assign Splunk roles to you Active Directory groups.

Re: How to configure Splunk to authenticate through LDAP?

jfeitosa_real — Wed, 05 Dec 2018 18:44:59 GMT

Hi, try this steps:
https://www.learnsplunk.com/splunk-ldap-authentication-configuration.html

Re: How to configure Splunk to authenticate through LDAP?

woodcock — Wed, 05 Dec 2018 19:08:53 GMT

LDAP is tough. I would suggest 2 things:

1: Watch this video, by @ninja, IT ROCKS: https://youtu.be/JEo6dNXigBo
2: Test/experiment with the ldapsearchtool; install with sudo yum -y install openldap