Deployment Architecture

what changes are there to scripted auth from 3.4.x to 4.1?

zscgeek
Path Finder

Are there are any critical changes to be aware of when migrating a complex distributed scripted auth setup on 3.4.x to 4.1?

For example:

  • Do we still need the auth script on both the search heads and search/indexer boxes?
  • If so does the user and password get sent from the search head to all the nodes?
  • Any changes to auth caching from 3.X?
Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Authentication changed between 3.4 and 4.0, and even more between 4.0 and 4.1:

  • No you don't need it on both, just on the search head.
  • Passwords are not sent.
  • I'm not sure what you specifically mean by "auth caching". If you mean the need to "reload auth" of a user when groups memberships have changed in the external source, then this has changed for LDAP and is now reloaded for each user when they log in. However, I do not know if it has changed for scripted authentication, but I suspect not.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Authentication changed between 3.4 and 4.0, and even more between 4.0 and 4.1:

  • No you don't need it on both, just on the search head.
  • Passwords are not sent.
  • I'm not sure what you specifically mean by "auth caching". If you mean the need to "reload auth" of a user when groups memberships have changed in the external source, then this has changed for LDAP and is now reloaded for each user when they log in. However, I do not know if it has changed for scripted authentication, but I suspect not.

jrodman
Splunk Employee
Splunk Employee

Auth cacheing meant that we cached the answer to the question "is this a valid user" or "is this user an admin" and suchlike for x seconds, so that we didn't run the script hundreds of times a second, or whatever silliness.

0 Karma

zscgeek
Path Finder

So the first thing I see so far is that search filters seem to have changed. Sadly on 4.1 so far setting scriptSearchFilters=1 in my auth config does not seem to fix it...

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...