Security
Highlighted

User authentication to multiple AD domains in Splunk

Path Finder

Is it possible to configure Splunk so that one can choose which Active Directory to login in to? For example in the login menu of Splunk web choose which AD I want to login to.

Tags (2)
Highlighted

Re: User authentication to multiple AD domains in Splunk

Champion

This is not currently possible, unfortunately. Other folks have asked for this feature and I believe it will come in a future release. If you're an Enterprise customer please file an ER to request it to help us gauge the interest.

Highlighted

Re: User authentication to multiple AD domains in Splunk

Path Finder

Thanks for the reply! I will fill an ER as soon as we become Enterprise customers. 🙂

0 Karma
Highlighted

Re: User authentication to multiple AD domains in Splunk

Path Finder

This could be done using another (free) product:

  1. Install Splunk on a Linux machine

  2. Install Centrify Express on that same machine.

  3. Join one of the domains

  4. Configure Splunk for PAM authentication.

Now, assuming the domains are in the same forest, or you have cross-forest trust between the domains, users can log into Splunk as windowsloginname@domain.name.

0 Karma
Highlighted

Re: User authentication to multiple AD domains in Splunk

Path Finder

Thanks! I will check Centrify Express out.

0 Karma
Highlighted

Re: User authentication to multiple AD domains in Splunk

Motivator

This is now possible (beginning with Splunk 5 in late 2012). You can configure mutiple LDAP servers and Splunk will try each one. The current limitation seems to be that the user must be able to authenticate and be in a splunk-role-assigned group on the same LDAP server ("scheme").

http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkwithmultipleLDAPservers

0 Karma