Security

How does precedence work for authorize.conf?

ddrillic
Ultra Champion

On the deployer server we have the authorize.conf under /opt/splunk/etc/shcluster/apps/key_all_authentication/local and on the search heads we ended up having authorize.conf under etc/system/local. Apparently the one under etc/system/local takes precedence, which seems to me a bit strange as search time precedence order starts usually with the apps...

What am I missing?

0 Karma
1 Solution

bheemireddi
Communicator

Yes, Splunk applies different precedence for the configuration files in global context vs app/user context. Below link should explain in detail. Since authorize.conf is a system configuration file and not a user/app context.

http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Wheretofindtheconfigurationfiles

Precedence order within global context:
When the context is global (that is, where there's no app/user context), directory priority descends in this order:

  1. System local directory -- highest priority
  2. App local directories
  3. App default directories
  4. System default directory -- lowest priority

View solution in original post

0 Karma

bheemireddi
Communicator

Yes, Splunk applies different precedence for the configuration files in global context vs app/user context. Below link should explain in detail. Since authorize.conf is a system configuration file and not a user/app context.

http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Wheretofindtheconfigurationfiles

Precedence order within global context:
When the context is global (that is, where there's no app/user context), directory priority descends in this order:

  1. System local directory -- highest priority
  2. App local directories
  3. App default directories
  4. System default directory -- lowest priority
0 Karma

ddrillic
Ultra Champion

Perfect - thank you.

0 Karma

bheemireddi
Communicator

Configs under system/local always gets precedence over the apps//system/local.
In regards to authorize.conf, since these are clustered search heads and you use deployer, would be better to use under apps to avoid confusion.

0 Karma

ddrillic
Ultra Champion

Fair enough. Since it's search time the following, in my mind, should apply

Configuration file precedence

It says

Precedence order within app or user context

When there's an app/user context, directory priority descends from user to app to system:

  1. User directories for current user -- highest priority
  2. App directories for currently running app (local, followed by default)
  3. App directories for all other apps (local, followed by default) -- for exported settings only
  4. System directories (local, followed by default) -- lowest priority

An attribute in savedsearches.conf, for example, might be set at all three levels: the user, the app, and the system. Splunk will always use the value of the user-level attribute, if any, in preference to a value for that same attribute set at the app or system level.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...