Change authentication schemes from native to LDAP on Splunk Enterprise

If you choose to move from the native Splunk authentication scheme to the LDAP scheme, you must remember that this change does not automatically disable native Splunk platform accounts. Accounts on the native Splunk authentication scheme take precedence over external authentication schemes, including the LDAP scheme.

In this case, you might need to delete native Splunk users to ensure that you use users from the LDAP scheme. This is only necessary if usernames are the same in both schemes.

Secure local Splunk accounts

If you have configured Splunk Enterprise to use LDAP authentication, all local accounts using Splunk authentication are still present and active, including the "admin" account. You must consider the security implications of this.

To remove all the current local accounts after you enable LDAP authentication:

1. On the Splunk Enterprise instance where you want to disable the native user accounts, use a command prompt or file system tools to move the $SPLUNK_HOME/etc/passwd file to a different file, such as passwd.bak.
2. Create a blank $SPLUNK_HOME/etc/passwd file.
3. Restart Splunk Enterprise.

You can still create accounts in the native authentication scheme when Splunk Enterprise uses LDAP for authentication. Also, any native Splunk accounts that must remain for backup or disaster-recovery purposes must use a strong password.

When you use LDAP for authentication, confirm that your LDAP implementation enforces:

• Strong password requirements for length and complexity.
• A low incorrect attempt threshold for password lockout.

How saved searches work under the LDAP authentication scheme

If the usernames you use with the LDAP authentication scheme are the same that you previously used, but deleted, in the native scheme, you can run saved searches without any kind of configuration change.

If you want to transfer ownership of saved searches from a user under the native authentication scheme to a user under the LDAP scheme, you can edit the saved search metadata to make the LDAP user the owner of the saved search.

1. On the Splunk Enterprise instance that contains the saved searches whose owner you want to change, use a text editor to modify the $SPLUNK_HOME/etc/apps/<app_name>/metadata/local.meta file.
2. Under each savedsearch permission stanza in this file, swap the owner = <username> field to the corresponding LDAP username.
3. Save changes to the file..
4. Restart Splunk Enterprise for your changes to take effect.