About multifactor authentication with RSA Authentication Manager

Multifactor authentication allows you to configure a primary and secondary login for your Splunk Enterprise users. You can configure multifactor authentication using RSA Authentication Manager for Splunk Web, REST endpoints, and CLI. Multifactor authentication secures the Splunk Enterprise web (8000) and management (8089) ports. After multifactor authentication is configured, the user enters a passcode to log in. The passcode is a combination of the user's authentication PIN and the RSA-generated tokencode. For example, if the user's PIN is 1111 and RSA generates a tokencode of 2222, the passcode is 11112222. The tokencode may be generated from an RSA key fob or a mobile/desktop application.

Prerequisites

You need to have configured your RSA Authentication Manager before you attempt to configure RSA authentication on your Splunk Enterprise installation.

You need to have the change_authentication capability to configure multifactor authentication with RSA Authentication Manager.

Caveats

You cannot configure multifactor authentication in the following circumstances:

• REST endpoints authenticate via pass4symmkey.
• You have a configuration where there is a distributed search without index clustering where peers are added to the distsearch.conf file by entering the credentials of an admin user on the indexer. This is a one-time operation that is needed to push the search head's public key to the indexer.

How multifactor authentication works with other forms of authentication

Note that you cannot use any form of multifactor authentication with SSO or SAML authentication. Multifactor authentication works with the following sources of authentication:

• Native authentication
• LDAP
• Scripted authentication