Security

How to create groups in Splunk, but keep users in LDAP?

cabodj
Engager

We would like to point Splunk to our LDAP, but have the ability to create groups within Splunk. These groups would only be saved within Splunk (no attempt to create the group in LDAP), and then we'd add LDAP users to the Splunk group.

This gives us the advantage of pointing to the corporate LDAP (or AD) for authentication, yet as Splunk owners we'd have the capability to manage groups and group membership for Splunk itself for authorization.

Is this possible?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes. Simply define the groups within Splunk as the users, i.e., define each user to Splunk as its own "group", using "dn" as the groupMemberAttribute. (Also define the users normally as users, using dn as the groupmappingattribute.) Then you'll be able to assign each user to a role (since each user will be their own "group").

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes. Simply define the groups within Splunk as the users, i.e., define each user to Splunk as its own "group", using "dn" as the groupMemberAttribute. (Also define the users normally as users, using dn as the groupmappingattribute.) Then you'll be able to assign each user to a role (since each user will be their own "group").

View solution in original post

the_wolverine
Champion

Good answer....

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!