Security

Account lockout when using LDAP authentication for users?

chris_barrett
Communicator

We have our authentication tied to AD using the LDAP strategy.   Password complexity and lifetime is, as a result, handled by the requirements set by the AD Group Policy.  But what about failed login attempts?  If a user manages to type in their password incorrectly multiple times (or worse, someone tries to incorrectly guess a user's password multiple times), will it cause their account to become locked within Splunk (and possibly within the underlying OS too?)

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If someone is locked out of their LDAP account then they are also locked out of Splunk.  However, Splunk is unaware of that.  I merely asks the LDAP server if the user is authenticated and if the server responds with "no" then they are not allowed in.

The 'admin' user still has access to Splunk, however, since it is a local account.

If your OS also uses LDAP then the same applies there as well.

---
If this reply helps you, Karma would be appreciated.
0 Karma

chris_barrett
Communicator

But what if the user (or someone else) types in the user's id and then fails to enter the correct password multiple times.  Will the account become locked out? 

The specific situation here is that the authentication is tied to the client's AD.    If the wrong password is typed in for a user on the Splunk login page multiple (let's say 10 times), will the account become locked either within Splunk, or within AD, or both, or neither?

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Easiest way to check how it is configured on your environment is asking from your ad admins and/or just test it. I think that it depends how it is configured.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...