Deployment Architecture

Seeking documentation re: LDAP strategies on a search head cluster in 6.6.1

robgarner
Path Finder

Hi -

My site has some standalone 6.2 search heads and recently implemented a new cluster of 6.6.1 search heads as well.

I've enabled LDAP authentication, defined a default strategy, and mapped LDAP groups to roles on the cluster, but there are some puzzling differences between 6.2 stand-alone and 6.6.1 clustered that I'm hoping to learn more about. Specifically, there are a number of strategies (settings -> access controls -> authentication method -> LDAP strategies) listed that I didn't create and can't delete/clone/enable but seem to be related to my "default" strategy. Their names are: authenticaiton, cacheTiming,roleMap_default, secrets. And while I can create additional strategies, the only one I can "enable" is "default". I've tried these operations from all cluster members with the same results on all.

I've read lots of docs about 6.6.1 search head clusters and LDAP authentication, but nothing I saw discussed automatically created strategies. Anyone got any pointers that'll help me understand this ?

Thanks,
-Rob

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

If the UI does not clarify the settings, you can check the configuration specifications, in particular the authentication.conf

see : http://docs.splunk.com/Documentation/Splunk/latest/Admin/authenticationconf

and the manual LDAP setup on the config file.
http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureLDAPwithconfigurationfiles

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

If the UI does not clarify the settings, you can check the configuration specifications, in particular the authentication.conf

see : http://docs.splunk.com/Documentation/Splunk/latest/Admin/authenticationconf

and the manual LDAP setup on the config file.
http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureLDAPwithconfigurationfiles

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...