Splunk Cloud Platform

LDAP for Splunk cloud

Lien
Explorer

I am thinking about which way is better to use LDAP(AD) or SAML for authentication of Splunk Cloud.

Unlike Splunk standalone, the cloud version looks like a little tricky.

I read some document that Splunk Cloud is not recommend to connect to AD- LDAP directly somewhere. But I could not find where they are.

I am trying to connect LDAP from Splunk Cloud, but always got error and there were very few inforamtion showing in splunkd.log

Can someone let me know if the direct connect to AD LDAP from Spunk cloud is recommended or not?

Also if there is any trouble shooting tool can easily built the connection?

Labels (1)
0 Karma
1 Solution

PrewinThomas
Motivator

@Lien 

You're right, connecting Splunk Cloud directly to an on-premise Active Directory via LDAP is generally not the recommended or straightforward approach, and SAML is highly preferred.

Why SAML is Better for Splunk Cloud:
Enhanced Security:
-Your AD is not directly exposed to the internet for Splunk Cloud.
-Authentication happens at your IdP. Splunk Cloud trusts the assertion from your IdP.
-Easier to enforce Multi-Factor Authentication (MFA) via your IdP.
Standardized Integration: SAML is a web browser SSO standard. It's well-understood and robust.
Centralized Identity Management: Leverages your existing identity management infrastructure.
No Direct Network Dependency:Splunk Cloud doesn't need a persistent network connection to your AD for authentication transactions.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!

View solution in original post

Lien
Explorer

Thank you so much for the prompt answer!

0 Karma

PrewinThomas
Motivator

@Lien 

You're right, connecting Splunk Cloud directly to an on-premise Active Directory via LDAP is generally not the recommended or straightforward approach, and SAML is highly preferred.

Why SAML is Better for Splunk Cloud:
Enhanced Security:
-Your AD is not directly exposed to the internet for Splunk Cloud.
-Authentication happens at your IdP. Splunk Cloud trusts the assertion from your IdP.
-Easier to enforce Multi-Factor Authentication (MFA) via your IdP.
Standardized Integration: SAML is a web browser SSO standard. It's well-understood and robust.
Centralized Identity Management: Leverages your existing identity management infrastructure.
No Direct Network Dependency:Splunk Cloud doesn't need a persistent network connection to your AD for authentication transactions.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!

Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...