Set up user authentication with Splunk's built-in system
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Set up user authentication with Splunk's built-in system
Splunk ships with support for three types of authentication systems:
- Splunk's own built-in system, described in the topic you're now reading.
- LDAP, described in Set up user authentication with LDAP.
- A scripted authentication API for use with an external authentication system, such as PAM or RADIUS, described in Configure Splunk to use scripted authentication.
Splunk's built-in system always takes precedence over any external systems. This is the order in which Splunk authenticates a user:
1. Splunk built-in authentication
2. LDAP authentication (if enabled)
3. Scripted authentication (if enabled)
This topic describes how to create new users and change the properties (like password) of existing users using Splunk's built-in authentication system.
This topic also describes how to assign users to roles in Splunk's role-based access control system. Even if you're using LDAP or scripted authentication to authenticate users, you still need to follow the instructions in this topic on assigning roles to users.
Note: Role names must use lowercase characters. For example: "admin", not "Admin". User names, however, are entirely case-insensitive: "Jacque", "jacque", "JacQue" are all the same to Splunk.
Add and edit users
You can use Splunk Web or the CLI to add and edit users and assign them roles.
Note: Members of multiple roles inherit capabilities and properties from the role with the broadest permissions. In the case of search filters, if a user is assigned to roles with different search filters, they are all combined via OR.
Use Splunk Web
In Splunk Web:
1. Click Manager.
2. Click Access controls.
3. Click Users.
4. Click New or edit an existing user.
5. Specify new or changed information for this user.
6. Assign this user to an existing role or roles and click Save.
When you create a user, you can create a role for that user as well. You can then edit that role to specify what access that user has to Splunk.
Use the CLI
In the CLI, use the add user command. Here are some examples:
- To add a new administrator user with the password "changeme2":
./splunk add user admin2 -password changeme2 -role admin -auth admin:changeme
- To change an existing user's password to "fflanda":
./splunk edit user admin -password fflanda -role admin -auth admin:changeme
NB: Passwords with special characters that would be interpreted by the shell (for example '$' or '!') must be either escaped or single-quoted. For example:
./splunk edit user admin -password 'fflanda$' -role admin -auth admin:changeme
or
./splunk edit user admin -password fflanda\$ -role admin -auth admin:changeme
Map a user to a role via Splunk Web
Once you've created a role in authorize.conf, map a user or users to it via Splunk Web:
1. Click on the Manager link in the upper right-hand corner.
2. Click the Users link.
3. Edit an existing user or create a new one.
4. Choose which role to map to from the Role list.
- Any custom roles you have created in
authorize.confwill be listed here.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 View the Article History for its revisions.