Authentication Methods
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Authentication Methods
Authentication refers to the process of validating the identity of the requesting client. Authorization can only occur after authentication, and refers to the process of granting permission to the requesting client for performing a certain action. Unfortunately, the HTTP standard named its authentication header incorrectly. It's confusing.
The splunkd HTTPS server supports the following authentication methods:
- HTTP header auth
- HTTP digest auth
- URL parameters
All requests return an HTTP 401 code if the credentials are invalid. An HTTP 403 is returned if the credentials are valid but the request was denied because of insufficient privileges.
HTTP header auth
Splunkd supports token-based authentication via the standard HTTP authentication headers.
- Obtain a session key via the
/services/auth/loginendpoint, for example71e2f3553ba1dd279e36a6920a1e7840. - Insert the session key into the auth header of every subsequent request, as follows:
Authorization: Splunk 71e2f3553ba1dd279e36a6920a1e7840
HTTP digest
Splunkd supports HTTP digest authentication, as defined by RFC 2617. This is the method that is invoked when you browse the HTTP server from a web browser. Most modern HTTP clients support digest authentication natively. You can't use HTTP Digest on non-Splunk users. For example, if you are using LDAP for auth in Splunk, those users won't be able to be authenticated with the HTTP Digest methods.
Use this method by to authenticate via a URL:
http://admin:changeme@localhost:8089/
Your favorite programming language's web library will have different ways of handling this. Examples in this manual use Python.
URL Parameters
URL parameters refers to the older style of authentication used by Splunk versions 1.0 through 3.1. This method is only available for legacy applications, or instances where LDAP is the primary means of authentication.
- Obtain the
authStrgenerated by the olderuserLogin invokeAPIcall. The string is an XML fragment that contains 3 key nodes:userId,username, andauthToken. - Append those 3 values to the final request URI.
For example:
https://localhost:8089/services/search/jobs
Ends up as:
https://localhost:8089/services/search/jobs?userId=1&username=admin&authToken=135932556
This documentation applies to the following versions of Splunk: 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.