We would like to point Splunk to our LDAP, but have the ability to create groups within Splunk. These groups would only be saved within Splunk (no attempt to create the group in LDAP), and then we'd add LDAP users to the Splunk group.
This gives us the advantage of pointing to the corporate LDAP (or AD) for authentication, yet as Splunk owners we'd have the capability to manage groups and group membership for Splunk itself for authorization.
Is this possible?
... View more