LDAP for Splunk cloud

[Lien]

I am thinking about which way is better to use LDAP(AD) or SAML for authentication of Splunk Cloud.

Unlike Splunk standalone, the cloud version looks like a little tricky.

I read some document that Splunk Cloud is not recommend to connect to AD- LDAP directly somewhere. But I could not find where they are.

I am trying to connect LDAP from Splunk Cloud, but always got error and there were very few inforamtion showing in splunkd.log

Can someone let me know if the direct connect to AD LDAP from Spunk cloud is recommended or not?

Also if there is any trouble shooting tool can easily built the connection?

[Lien]

Thank you so much for the prompt answer!

[PrewinThomas · Accepted solution]

@Lien 

You're right, connecting Splunk Cloud directly to an on-premise Active Directory via LDAP is generally not the recommended or straightforward approach, and SAML is highly preferred.

Why SAML is Better for Splunk Cloud:
Enhanced Security:
-Your AD is not directly exposed to the internet for Splunk Cloud.
-Authentication happens at your IdP. Splunk Cloud trusts the assertion from your IdP.
-Easier to enforce Multi-Factor Authentication (MFA) via your IdP.
Standardized Integration: SAML is a web browser SSO standard. It's well-understood and robust.
Centralized Identity Management: Leverages your existing identity management infrastructure.
No Direct Network Dependency:Splunk Cloud doesn't need a persistent network connection to your AD for authentication transactions.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!