How to configure authentication in distributed environment

New Member

I have a handful of Splunk servers. I'm trying to understand, does authentication work like deployed apps? Meaning, if I add a new role/ldap group mapping on the search head cluster master or on the deployment server, should I expect that configuration to replicate to the search heads, indexers, etc?
Or do I need to create that role and mapping on each search head individually?

0 Karma

Esteemed Legend

If you are not using a Search Head Cluster, but instead are using individual Search Heads, you can do it like this:

0 Karma

Super Champion

On Search Head Clusters, you should NOT use "deployment-server" nor by cluster master, but the distributing component to manage Search Head is called as "deployer". So create an app with its authentication.conf and authorize.conf with the details and push it via deployer. It will go into the Search Head members and get's replicated automatically.

Attached is document and working code example in github

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>