Scripted SecurID/Radius authentication (next token/New PIN/locked token)

Path Finder

We are setting Splunk up to use Radius with SecurID (2 factor). We have this working, but ran into an issue when a SecurID token is not in a "normal" mode.

SecurID has what is called new pin mode where a Radius/SecurID site will prompt the user to create a new PIN for their SecurID card as well as a "Next token" mode where the site being authenticated to will prompt the user after they enter the number on their SecurID card when it changes in order to re-sync the token and the SecurID server. Also (I haven't been able to test this) SecurID users tokens could be locked and require a reset.

We are hoping that there is a way to prompt the user for New PIN, next token and inform them their token is locked via the Splunk login page. I know that the existing Radius authentication script does not support this, but even if we were able to re-write the script I am wondering if Splunk can be customized in a way to provide the ability to deal with those 3 scenarios (New PIN/Next Token/Token Locked).

0 Karma

Splunk Employee
Splunk Employee

There is really no facility to do this in Splunk. If the user can't log into Splunk, they may be required to go to some other url/application to update their PIN.

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...