Add users to the search head cluster

In a search head cluster, all cluster members should maintain the same set of users, with the same set of roles.

To add users to the search head cluster, you can use any of the available authentication methods: Splunk Enterprise built-in authentication, LDAP, SAML, or scripted authentication. See the chapters on authentication in the Securing Splunk Enterprise manual for details.

The cluster automatically synchronizes user configurations across the set of members, in most cases. It uses configuration replication to do this. See "Configuration updates that the cluster replicates."

Use Splunk Enterprise built-in authentication

For Splunk Enterprise built-in authentication, you can use Splunk Web or the CLI to add users and map roles. Perform the operation on any one of the cluster members. The cluster then automatically distributes the changes to all members by replicating the $SPLUNK_HOME/etc/passwd file.

Authentication restrictions

Search head clustering does have a few restrictions regarding how you configure authentication:

• The cluster replicates the configuration changes automatically only if you configure authentication through Splunk Web, the Splunk CLI, or REST endpoints. If, instead, you edit a configuration file directly, you must use the deployer to distribute the file to the cluster members.

• Even when you configure authentication through Splunk Web, the CLI, or REST endpoints, the cluster only replicates the underlying configuration files, plus the $SPLUNK_HOME/etc/passwd file in the case of built-in authentication. If the authentication method that you are employing requires any other associated, non-configuration files, you must use the deployer to distribute them to the cluster members. For example:

• For SAML, you must use the deployer to push the certificates.

• For scripted authentication, you must use the deployer to push the script. You must also use the deployer to push authentication.conf, because you can only configure scripted authentication by editing authentication.conf directly.

How to use the deployer to push authentication files

To push arbitrary groups of files, such as SAML certificates, from the deployer, you create an app directory specifically to contain those files.

For details on how to use the deployer to push files, see "Use the deployer to distribute apps and configuration updates."