Splunk Cloud Platform

LDAP for Splunk cloud

Lien
Explorer

I am thinking about which way is better to use LDAP(AD) or SAML for authentication of Splunk Cloud.

Unlike Splunk standalone, the cloud version looks like a little tricky.

I read some document that Splunk Cloud is not recommend to connect to AD- LDAP directly somewhere. But I could not find where they are.

I am trying to connect LDAP from Splunk Cloud, but always got error and there were very few inforamtion showing in splunkd.log

Can someone let me know if the direct connect to AD LDAP from Spunk cloud is recommended or not?

Also if there is any trouble shooting tool can easily built the connection?

Labels (1)
0 Karma
1 Solution

PrewinThomas
Motivator

@Lien 

You're right, connecting Splunk Cloud directly to an on-premise Active Directory via LDAP is generally not the recommended or straightforward approach, and SAML is highly preferred.

Why SAML is Better for Splunk Cloud:
Enhanced Security:
-Your AD is not directly exposed to the internet for Splunk Cloud.
-Authentication happens at your IdP. Splunk Cloud trusts the assertion from your IdP.
-Easier to enforce Multi-Factor Authentication (MFA) via your IdP.
Standardized Integration: SAML is a web browser SSO standard. It's well-understood and robust.
Centralized Identity Management: Leverages your existing identity management infrastructure.
No Direct Network Dependency:Splunk Cloud doesn't need a persistent network connection to your AD for authentication transactions.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!

View solution in original post

Lien
Explorer

Thank you so much for the prompt answer!

0 Karma

PrewinThomas
Motivator

@Lien 

You're right, connecting Splunk Cloud directly to an on-premise Active Directory via LDAP is generally not the recommended or straightforward approach, and SAML is highly preferred.

Why SAML is Better for Splunk Cloud:
Enhanced Security:
-Your AD is not directly exposed to the internet for Splunk Cloud.
-Authentication happens at your IdP. Splunk Cloud trusts the assertion from your IdP.
-Easier to enforce Multi-Factor Authentication (MFA) via your IdP.
Standardized Integration: SAML is a web browser SSO standard. It's well-understood and robust.
Centralized Identity Management: Leverages your existing identity management infrastructure.
No Direct Network Dependency:Splunk Cloud doesn't need a persistent network connection to your AD for authentication transactions.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...