Set up user authentication with external systems

You can use scripted authentication, such as with external protocols and services like privileged access management (PAM) and remote authentication dial-in user service (RADIUS), to log users into Splunk Enterprise. Read this topic to learn about the steps you need to take to configure scripted authentication on Splunk Enterprise deployments.

Native Splunk authentication takes precedence over any other type of authentication scheme. When you configure scripted authentication, the Splunk native authentication scheme still processes logins before passing the request onward to the scripted authentication scheme.

Splunk Cloud Platform doesn't support scripted authentication of any kind. Don't try to use scripted authentication to log users into Splunk Cloud, even by using a Splunk app.

How scripted authentication works

In scripted authentication, a Python script that you create serves as the middleman between Splunk Enterprise and an external authentication system such as PAM or RADIUS.

The API consists of a few functions that handle communications between Splunk Enterprise and the authentication system. You need to create a script with handlers that implement those functions.

To integrate your authentication system with Splunk Enterprise, confirm that the authentication system is running and then do the following:

1. Create a Python authentication script. See Create the authentication script for the procedure.
2. Enable your script by editing the authentication.conf configuration file to specify scripted authentication and its associated settings. See Edit authentication.conf for the procedure.

Example scripts

Splunk provides several example authentication scripts and associated configuration files, including one set for RADIUS and another for PAM. There is also a simple script called dumbScripted.py, which focuses on the interaction between the script and Splunk deployments.

The scripts that Splunk provides are examples that you can modify or extend as needed. Splunk does not support them, and there is no guarantee that they will fully meet your authentication and security needs.

You can use an example script and configuration file as the starting point for creating your own script. You must modify them for your environment.

You can find these examples in $SPLUNK_HOME/share/splunk/authScriptSamples/. That directory also contains a README file with information on the examples, as well as additional information on setting up the connection between Splunk Enterprise and external systems.