How to create groups in Splunk, but keep users in LDAP?

[cabodj]

We would like to point Splunk to our LDAP, but have the ability to create groups within Splunk. These groups would only be saved within Splunk (no attempt to create the group in LDAP), and then we'd add LDAP users to the Splunk group.

This gives us the advantage of pointing to the corporate LDAP (or AD) for authentication, yet as Splunk owners we'd have the capability to manage groups and group membership for Splunk itself for authorization.

Is this possible?

[gkanapathy · Accepted solution]

Yes. Simply define the groups within Splunk as the users, i.e., define each user to Splunk as its own "group", using "dn" as the groupMemberAttribute. (Also define the users normally as users, using dn as the groupmappingattribute.) Then you'll be able to assign each user to a role (since each user will be their own "group").

[the_wolverine]

Good answer....