Security

authentication.conf multiple authType values

phemmer
Path Finder

I am wanting to set up multiple authentication types, both LDAP and scripted. I would thus need to somehow set multiple authType values in the authentication.conf. However from reading the documentation on authentication.conf, it does not indicate that this can be done. I just wanted to know if this is not possible, or if it's just not documented well.

Basically I want to use both LDAP and scripted authentication. LDAP will be used for normal users, but we have some system processes which use splunk, and I want them to be authenticated by a script. The hope is that splunk will first try to authenticate off one source, and if that fails, try the next one.

Worst case scenario I could move the LDAP authentication into the script so that it could then do both, but that's just ugly and I'm hoping to avoid it.

Tags (1)
0 Karma
1 Solution

phemmer
Path Finder

I ended up writing a script to do both. This actually turned out somewhat beneficial as I built the script to authenticate against PAM instead of LDAP. We use sssd for authentication, so this gives the benefit that if LDAP goes down, splunk will use the offline caching mechanism of sssd for authentication and users will still be able to log in.

View solution in original post

0 Karma

phemmer
Path Finder

I ended up writing a script to do both. This actually turned out somewhat beneficial as I built the script to authenticate against PAM instead of LDAP. We use sssd for authentication, so this gives the benefit that if LDAP goes down, splunk will use the offline caching mechanism of sssd for authentication and users will still be able to log in.

0 Karma

LukeMurphey
Champion

I came to the same conclusion as you: it doesn't appear to be possible.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...