User authentication to multiple AD domains in Splunk

[joberget]

Is it possible to configure Splunk so that one can choose which Active Directory to login in to? For example in the login menu of Splunk web choose which AD I want to login to.

[Jason]

This is now possible (beginning with Splunk 5 in late 2012). You can configure mutiple LDAP servers and Splunk will try each one. The current limitation seems to be that the user must be able to authenticate and be in a splunk-role-assigned group on the same LDAP server ("scheme").

http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkwithmultipleLDAPservers

[mpatnode]

This could be done using another (free) product:

1. Install Splunk on a Linux machine

2. Install Centrify Express on that same machine.

3. Join one of the domains

4. Configure Splunk for PAM authentication.

Now, assuming the domains are in the same forest, or you have cross-forest trust between the domains, users can log into Splunk as [email protected].

[joberget]

Thanks! I will check Centrify Express out.

[joberget]

Thanks for the reply! I will fill an ER as soon as we become Enterprise customers. 🙂

[the_wolverine]

This is not currently possible, unfortunately. Other folks have asked for this feature and I believe it will come in a future release. If you're an Enterprise customer please file an ER to request it to help us gauge the interest.