Security

LDAP Authentication - Adding LDAP User in Splunk using CLI command

rajiv_kumar
Path Finder

Hi,

I have two searchhead node and need to add LDAP users in both nodes. I can add using Splunk UI but I am looking to add using CLI command. Looks lke the file etc/system/local/authentication.conf has LDAP user info. I have added in this file but not working.

Please let me know if any solution.

Thanks, Rajiv

Tags (1)
0 Karma
1 Solution

bwooden
Splunk Employee
Splunk Employee

authentication.conf instructs Splunk how to validate user credentials and authorize.conf instructs Splunk as to what users are allowed to do.

If you copy both from the .../local path of a known good configuration and re-start Splunk, it should work on the new instance as well

View solution in original post

the_wolverine
Champion

Most likely the ldap password is improperly hashed for the instance on which authentication.conf was copied to. To get around this, just rekey the ldap password in plaintext (in authentication.conf) and restart Splunk. The password gets properly rehashed on restart.

bwooden
Splunk Employee
Splunk Employee

authentication.conf instructs Splunk how to validate user credentials and authorize.conf instructs Splunk as to what users are allowed to do.

If you copy both from the .../local path of a known good configuration and re-start Splunk, it should work on the new instance as well

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...