Security

How to create groups in Splunk, but keep users in LDAP?

cabodj
Engager

We would like to point Splunk to our LDAP, but have the ability to create groups within Splunk. These groups would only be saved within Splunk (no attempt to create the group in LDAP), and then we'd add LDAP users to the Splunk group.

This gives us the advantage of pointing to the corporate LDAP (or AD) for authentication, yet as Splunk owners we'd have the capability to manage groups and group membership for Splunk itself for authorization.

Is this possible?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes. Simply define the groups within Splunk as the users, i.e., define each user to Splunk as its own "group", using "dn" as the groupMemberAttribute. (Also define the users normally as users, using dn as the groupmappingattribute.) Then you'll be able to assign each user to a role (since each user will be their own "group").

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes. Simply define the groups within Splunk as the users, i.e., define each user to Splunk as its own "group", using "dn" as the groupMemberAttribute. (Also define the users normally as users, using dn as the groupmappingattribute.) Then you'll be able to assign each user to a role (since each user will be their own "group").

the_wolverine
Champion

Good answer....

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...