Set up user authentication with LDAP

The Splunk platform supports several types of authentication schemes, including the Lightweight Directory Access Protocol (LDAP).

About configuring LDAP authentication for

The Splunk platform lets you configure user and role configuration for LDAP users and groups. You can configure the Splunk platform to use one or many LDAP servers, then map users and user groups from your servers to Splunk roles. You can also configure Splunk authentication tokens for LDAP users.

Before you configure the Splunk platform for LDAP, read LDAP prerequisites and considerations.

After you configure LDAP as an authentication scheme, see Set up authentication with tokens if you want information on creating authentication tokens for LDAP users.

How to configure LDAP as an authentication scheme

Following are the main steps to configure the Splunk platform to work with LDAP for authentication:

1. Configure one or more LDAP strategies, typically one strategy per LDAP server.
2. Map LDAP groups to one or more Splunk roles.
3. If you have multiple LDAP servers, specify the connection order of the servers.

In Splunk Cloud Platform, you can perform these steps in Splunk Web. See Configure LDAP with Splunk Web.

In Splunk Enterprise, you can use either Splunk Web or configuration files to configure LDAP. To use configuration files to configure LDAP, see Configure LDAP with configuration files.

If you need to configure multiple LDAP servers to work with your Splunk platform instance, see How Splunk works with multiple LDAP servers.

Precedence of Splunk authentication schemes

The native Splunk authentication scheme takes precedence over any external schemes. Precedence is the order in which the Splunk platform authenticates a user:

1. The Splunk platform attempts native authentication to log the user in first. If authentication fails, and the failure is not due to a nonexistent local account, then the platform does not attempt to use LDAP to login.
2. If the failure is due to a nonexistent local account, then the Splunk platform attempts a login using the LDAP authentication scheme.
3. On Splunk Enterprise only, if you have configured scripted authentication, the instance then attempts to log in using a script. For more information about scripted authentication, see Set up user authentication with external systems.