Security

LDAP authentication caching

bobwalden
Explorer

Hi;

Seems like, with LDAP integrated and roles mapped to LDAP groups, Splunk will update its cached list of users and their roles only when a splunkweb session starts--ie, if we add a user to a mapped role, this does not show up in Manage > Access Controls > Users, but after that user logs in, he/she now shows up in that list.

On the other hand, if we make changes to that user's role, and he/she is currently logged into splunk web, that change will not take effect unless they log out and back in--correct?

We know we can hit manage > Access Controls > Authentication method > Reload authentication method to reset, but:

a) is there any setting in authentication.conf or limits.conf to make this happen on a periodic basis?

b) we see that according to http://blogs.splunk.com/2009/08/20/reload-4-auth/, we can do this via a cron job, but is this still best practice in 5.0 +?

thanks,
bw

Tags (1)
1 Solution

the_wolverine
Champion

We're encountering strange issues with LDAP in version 5 and have implemented our workaround which is scripting of the auth reload command on a regular basis.

View solution in original post

0 Karma

the_wolverine
Champion

We're encountering strange issues with LDAP in version 5 and have implemented our workaround which is scripting of the auth reload command on a regular basis.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...