Security

How does precedence work for authorize.conf?

ddrillic
Ultra Champion

On the deployer server we have the authorize.conf under /opt/splunk/etc/shcluster/apps/key_all_authentication/local and on the search heads we ended up having authorize.conf under etc/system/local. Apparently the one under etc/system/local takes precedence, which seems to me a bit strange as search time precedence order starts usually with the apps...

What am I missing?

0 Karma
1 Solution

bheemireddi
Communicator

Yes, Splunk applies different precedence for the configuration files in global context vs app/user context. Below link should explain in detail. Since authorize.conf is a system configuration file and not a user/app context.

http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Wheretofindtheconfigurationfiles

Precedence order within global context:
When the context is global (that is, where there's no app/user context), directory priority descends in this order:

  1. System local directory -- highest priority
  2. App local directories
  3. App default directories
  4. System default directory -- lowest priority

View solution in original post

0 Karma

bheemireddi
Communicator

Yes, Splunk applies different precedence for the configuration files in global context vs app/user context. Below link should explain in detail. Since authorize.conf is a system configuration file and not a user/app context.

http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Wheretofindtheconfigurationfiles

Precedence order within global context:
When the context is global (that is, where there's no app/user context), directory priority descends in this order:

  1. System local directory -- highest priority
  2. App local directories
  3. App default directories
  4. System default directory -- lowest priority
0 Karma

ddrillic
Ultra Champion

Perfect - thank you.

0 Karma

bheemireddi
Communicator

Configs under system/local always gets precedence over the apps//system/local.
In regards to authorize.conf, since these are clustered search heads and you use deployer, would be better to use under apps to avoid confusion.

0 Karma

ddrillic
Ultra Champion

Fair enough. Since it's search time the following, in my mind, should apply

Configuration file precedence

It says

Precedence order within app or user context

When there's an app/user context, directory priority descends from user to app to system:

  1. User directories for current user -- highest priority
  2. App directories for currently running app (local, followed by default)
  3. App directories for all other apps (local, followed by default) -- for exported settings only
  4. System directories (local, followed by default) -- lowest priority

An attribute in savedsearches.conf, for example, might be set at all three levels: the user, the app, and the system. Splunk will always use the value of the user-level attribute, if any, in preference to a value for that same attribute set at the app or system level.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...