Implementing Splunk (Update)

Using LDAP for authentication

By default, Splunk authenticates using its own authentication system, which simply stores users and roles in flat files. The other two options available are LDAP and scripted authentication.

To enable LDAP authentication, perform the following steps:

1. Navigate to Manager | Access controls | Authentication method.
2. Check the LDAP checkbox.
3. Click on Configure Splunk to use LDAP and map groups.
4. Click on New.

You will then need the appropriate values to set up access to your LDAP server.

Every organization sets up LDAP slightly differently, so I have never managed to configure this properly the first time. Your best bet is to copy the values from another application that is already configured in your organization.

Once LDAP is ...