Splunk® Enterprise

Securing Splunk Enterprise

Splunk Enterprise version 9.0 will no longer be supported as of June 14, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Connect your authentication system with Splunk Enterprise using the authentication.conf configuration file

To integrate your authentication system with your Splunk Enterprise deployment, use the authentication.conf file. Confirm that your authentication system runs properly, then perform the following steps:

  1. Create and test a Python authentication script. See Create the authentication script for the procedure.
  2. Edit the authentication.conf configuration file to enable the authentication script. See Enable your authentication script in this topic.
  3. Edit the authentication.conf file to set the authentication cache duration for your script. See Set authentication cache durations in this topic.

Enable your authentication script

After you create a Python script to implement authentication, you must update the authentication.conf file located in $SPLUNK_HOME/etc/system/local/ to enable your script. You can also copy and edit a sample authentication.conf from $SPLUNK_HOME/share/splunk/authScriptSamples/.

Specify Scripted as your authentication type under the [authentication] stanza heading:

[authentication]
authType = Scripted
authSettings = script

Set script variables under the [script] stanza heading. For example:

[script]
scriptPath = $SPLUNK_HOME/bin/python $SPLUNK_HOME/bin/<scriptname.py>

Set authentication cache durations

Enable authentication caching to significantly speed authentication performance when you use scripted authentication. You do so by adding the optional [cacheTiming] stanza in the authentication.conf file. Each script function (except getSearchFilter) has a cacheTiming setting, which turns on caching for that function and specifies its cache duration.

For example, to specify the cache timing for the getUserInfo function, use the userInfoTTL attribute. Caching for a function occurs only if you specify its associated setting.

The cacheTiming settings specify the frequency at which Splunk software calls your script to communicate with the external authentication system. You can specify the time in seconds (s), minutes (m), hours (h), or days (d). In most cases, limit the cache frequency to seconds or minutes. If you don't specify a time unit Splunk software uses seconds. For example, a value of "5" is equivalent to "5s".

This example shows typical values for the caches:

[cacheTiming]
userLoginTTL    = 10s
getUserInfoTTL  = 1m
getUsersTTL     = 2m

In most cases, set userLoginTTL to a low value, since this determines how long the Splunk platform caches user login and password validity.

To refresh all caches immediately, use the CLI command splunk reload auth:

./splunk reload auth

Running this command does not log current users out of the instance.

You can also refresh caches in Splunk Web:

  1. In the System menu, under Users and authentication select Access controls.
  2. Select Authentication method.
  3. Select Reload authentication configuration to refresh the caches.

Each function, except for getUsers, has a separate cache for each user. If, for example, you have 10 users logged on and you've specified the userInfoTTL setting, the getUserInfo function has 10 user-based caches. The getUsers function encompasses all users and has a single, global cache.

Last modified on 10 September, 2022
Create the authentication script   Use PAM authentication

This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters