There is no userid/password authentication for forwarders to indexers or forwarder to deployment server. What you can do, however, is use SSL certificate authentication. Each forwarder can have a client cert and use it to authenticate itself to the indexers / deployment server. Examples of how to do this are in my .conf 2014 session slides -- http://conf.splunk.com/sessions/2014/conf2014_DuaneWaddleGeorgeStarcher_Self_UsingTrack.pdf ... View more