topic Splunk SOAR ldap config files? in Splunk SOAR

Splunk SOAR ldap config files?

esgrav — Thu, 11 Dec 2025 12:33:16 GMT

Hi,

Anyone knows where ldap config files are stored for Splunk SOAR?

Doc only gives me the clickops way...

There is no directory where you can find this for other splunk compontents; $SPLUNK_HOME/etc/system/local/

So are they stored in DB or what?

Re: Splunk SOAR ldap config files?

phanTom — Thu, 11 Dec 2025 13:34:43 GMT

@esgrav I take it you are looking at a programmatic way to create/update the LDAP configuration?

I don't believe you can in the same way you can with Splunk and just inject a .conf file for LDAP. I have also checked the REST docs and there is no REST endpoint to configure this, hence I would make an educated guess that it can't be done any other way than the UI.

In ES8.x paired with SOAR 7.x then I think the LDAP scheme in Splunk can be used to manage access to SOAR as they are closer paired and AFAIK share the same authentication schema.

-- Please provide Karma if it helped, and mark it a solution if it resolved your query. Happy SOARing! --

Re: Splunk SOAR ldap config files?

esgrav — Thu, 11 Dec 2025 13:39:16 GMT

Ok, thanks for confirming my suspicion...