Security

User authentication to multiple AD domains in Splunk

joberget
Path Finder

Is it possible to configure Splunk so that one can choose which Active Directory to login in to? For example in the login menu of Splunk web choose which AD I want to login to.

Tags (2)

Jason
Motivator

This is now possible (beginning with Splunk 5 in late 2012). You can configure mutiple LDAP servers and Splunk will try each one. The current limitation seems to be that the user must be able to authenticate and be in a splunk-role-assigned group on the same LDAP server ("scheme").

http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkwithmultipleLDAPservers

0 Karma

mpatnode
Path Finder

This could be done using another (free) product:

  1. Install Splunk on a Linux machine

  2. Install Centrify Express on that same machine.

  3. Join one of the domains

  4. Configure Splunk for PAM authentication.

Now, assuming the domains are in the same forest, or you have cross-forest trust between the domains, users can log into Splunk as windowsloginname@domain.name.

0 Karma

joberget
Path Finder

Thanks! I will check Centrify Express out.

0 Karma

joberget
Path Finder

Thanks for the reply! I will fill an ER as soon as we become Enterprise customers. 🙂

0 Karma

the_wolverine
Champion

This is not currently possible, unfortunately. Other folks have asked for this feature and I believe it will come in a future release. If you're an Enterprise customer please file an ER to request it to help us gauge the interest.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...