LDAP authentication to multiple domains

[dbylertbg]

I have two LDAP strategies defined, one to domain1 and one to domain2. In both domains I have a user named "SplunkAdmin". Both ldap strategies have roles mapped to the groups that contain the SplunkAdmin user for each domain. However, in the "users" list, I only see one entry for "SplunkAdmin". How do I allow both users to access Splunk? (I have tried specifying the domain in the username box, i.e. domain1\splunkadmin or splunkadmin@domain1 as the username, but this approach does not seem to work.)

[grijhwani]

The only way to do this would be to have distinct users in distinct domains. I don't see how you would expect to see two different users when there is nothing to distinguish the name. The login (and user list) will match the first instance it finds according to the ordering of the domain strategies.

You could do what I have had to do recently, use a domain-specific attribute for the user name, and use logins SlunkAdmin@domain.one and SplunkAdmin@domain.two. Of course this depends entirely on how you have your LDAP configured on the domain controller side.

[dbylertbg]

Re: using an alternate domain-specific attribute for the user name: This would require significant effort on the AD side to ensure that unique attributes exists for each user in question. It may be our only option, though.

[dbylertbg]

In an AD environment you can specify a domain to attempt to log in to by entering the username in the format "DOMAIN\ussername" or "username@DOMAIN". I was hoping that Splunk could be configured to accept the same format.

[dbylertbg]

Working with Splunk support, it appears that there is no way to specify the domain when logging in. Instead, you must find an alternate 'user' attribute to match on, and the attributes must be unique between the two domains.