Security

How to create new user in Splunk with LDAP Authentication

alexspunkshell
Contributor

LDAP is already configured and i see many users with LDAP authentication.

Now i want to create new users with LDAP authendication. But i don't see any options to choose LDAP authentication. Pleas help here.

alexspunkshell_0-1606466475275.pngalexspunkshell_0-1606466475275.png

alexspunkshell_1-1606466516560.pngalexspunkshell_1-1606466516560.png

@isoutamo @ITWhisperer @gcusello @thambisetty 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

if you have LDAP authentication, you cannot create LDAP users in Splunk, only local Splunk users.

To create new LDAP users, you have to add them to one or more LDAP groups in Active Directory and automatically you'll have them in Splunk.

Ciao.

Giuseppe

View solution in original post

alexspunkshell
Contributor

Thanks for your clarification!

@gcusello @isoutamo 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Just add correct group in AD side those user and then add that group mapping to splunk side if needed.
When you are using AD authentication, you don't / shouldn't do anything else than create those needed roles and map those in splunk side. After those have done new users just created when needed. Of course they much match to your ldap user and group binding rules also.

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

if you have LDAP authentication, you cannot create LDAP users in Splunk, only local Splunk users.

To create new LDAP users, you have to add them to one or more LDAP groups in Active Directory and automatically you'll have them in Splunk.

Ciao.

Giuseppe

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...