radius_auth creates local account, how does this affect auth mechanism priority?

[jamesaarondevli]

Hello!

Once a RADIUS user authenticates against RADIUS, a user object is created in Splunk to represent that user. Once this occurs how does the radius_auth app continue to authenticate against RADIUS if a user with that name exists in Splunk?

Will it still fall through to RADIUS?

Cheers,
James

[LukeMurphey · Accepted solution]

Splunk treats users that were authenticated remotely differently than local accounts. Users will still be able to authenticate via RADIUS.

However, a true local account will take precedence over the RADIUS account.

[jamesaarondevli]

Thanks Luke!

I have another question but will raise it with a separate post to maintain some cohesiveness here.

Cheers,
James