Splunk Cloud Platform

Securing Splunk Cloud Platform

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Map LDAP groups and users to Splunk roles using configuration files

After you set up LDAP authentication and users, you can map LDAP groups and users to roles in Splunk Web.

As an alternative to using Splunk Web to map roles, on Splunk Enterprise, you can edit the authentication.conf configuration file contained in $SPLUNK_HOME/etc/system/local/. There are further examples at the end of the authentication.conf spec file.

To set up LDAP for Splunk Enterprise using configuration files, see Configure LDAP using configuration files. For information on configuration files in general, see About configuration files In the Admin Manual.

Map groups to roles

To map Splunk roles to groups in an LDAP strategy, you must set up a roleMap stanza for that strategy in the authentication.conf file. Each strategy requires its own roleMap stanza. The following example maps roles for groups in the "ldaphost1" strategy:

admin = SplunkAdmins
itusers = ITAdmins

Map users to roles directly

If you need to map users directly to Splunk roles, you can do so by setting the groupBaseDN setting in the authentication.conf file to the value of userBaseDN.

Also configuring the following settings to the same value as userNameAttribute:

  • groupMappingAttribute
  • groupMemberAttribute
  • groupNameAttribute

See the following example:

SSLEnabled = 0
bindDN = cn=Directory Manager
bindDNpassword = #########
groupBaseDN = ou=People,dc=splunksupport,dc=com
groupBaseFilter = (objectclass=*)
groupMappingAttribute = MyUserID
groupMemberAttribute = MyUserID
groupNameAttribute = MyUserID
host = supportldap.splunksupport.com
port = 389
realNameAttribute = cn
userBaseDN = ou=People,dc=splunksupport,dc=com
userBaseFilter = (objectclass=*)
userNameAttribute = MyUserID

admin = rlee;bsmith
Last modified on 15 October, 2021
Configure LDAP using configuration files
Test your LDAP configuration on Splunk Enterprise

This documentation applies to the following versions of Splunk Cloud Platform: 8.1.2103, 8.2.2105 (latest FedRAMP release), 8.2.2104, 8.2.2106, 8.2.2107, 8.2.2109

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters