Study guide
6.2 Other Authentication Options & Enabling Multifactor Authentication
Splunk Enterprise Certified Admin SPLK-1003
Track your progress as you read
Finished sections get a check mark.
1 Introduction
About the Splunk Enterprise Certified Admin Exam
2 Chapter 1: Splunk Admin Basics
1.1 Splunk Enterprise Architecture & Core Components
3 Chapter 2: License Management
2.1 License Types, Stacks, Pools & Licensing Architecture 2.2 License Violations, Rolling Window Warnings & Troubleshooting
4 Chapter 3: Splunk Configuration Files
3.1 Splunk Configuration Directory Structure 3.2 Configuration Layering, Precedence & Resolution Rules 3.3 Using btool to Inspect & Debug Configurations
5 Chapter 4: Splunk Indexes
4.1 Index Structure: Directories, Buckets & Bucket Files 4.2 Bucket Types & the Hot-Warm-Cold-Frozen-Thawed Lifecycle 4.3 Checking Index Data Integrity 4.4 indexes.conf Options: Paths, Bucket Sizing & Volumes 4.5 The Fishbucket: File Tracking, CRC Collisions & Re-reading Files 4.6 Applying a Data Retention Policy
6 Chapter 5: Splunk User Management
5.1 Splunk Roles, Capabilities & Custom Role Design 5.2 User Account Administration, Search Restrictions & Limits
7 Chapter 6: Splunk Authentication Management
6.1 Integrating Splunk with LDAP 6.2 Other Authentication Options & Enabling Multifactor Authentication
8 Chapter 7: Getting Data In
7.1 CLI Administration & Basic Data Onboarding Workflows 7.2 Forwarder Types: Universal Forwarder vs. Heavy Forwarder
9 Chapter 8: Distributed Search
8.1 How Distributed Search Works 8.2 Roles of the Search Head and Search Peers 8.3 Configuring Search Peers & Distributed Search Groups 8.4 Search Head Scaling & Search Head Clustering (SHC)
10 Chapter 9: Getting Data In – Staging
9.1 Ingestion Pipeline Stages: Input, Parsing, Merging, Typing & Indexing 9.2 Pipeline Component Placement & Queue Management 9.3 Splunk Input Options
11 Chapter 10: Configuring Forwarders
10.1 Forwarder Setup & outputs.conf Load Balancing 10.2 Indexer Acknowledgment, Data Cloning & Forwarder Routing
12 Chapter 11: Forwarder Management
11.1 Deployment Management & the Deployment Server 11.2 Deployment Apps & Deployment Clients 11.3 Server Classes, Client Grouping & App Deployment Strategies 11.4 Forwarder Management Monitoring & Troubleshooting
13 Chapter 12: Monitor Inputs
12.1 File & Directory Monitoring Mechanics 12.2 Monitor Input Tuning: Whitelists, Blacklists & CRC Settings 12.3 Deploying a Remote Monitor Input, Network Shares & Archives
14 Chapter 13: Network and Scripted Inputs
13.1 Creating Network Inputs: TCP & UDP 13.2 Optional Settings for Network Inputs 13.3 Scripted Inputs & PowerShell Data Collection
15 Chapter 14: Agentless Inputs
14.1 Windows Management Instrumentation (WMI) Inputs 14.2 HTTP Event Collector (HEC) Architecture & Administration
16 Chapter 15: Fine Tuning Inputs
15.1 Input-Phase Processing & Default Metadata Assignment 15.2 Character Set Encoding & Handling Binary Data
17 Chapter 16: Parsing Phase and Data
16.1 Line Breaking & Event Segmentation 16.2 Timestamp Extraction, Time Zones & Clock Skew Handling 16.3 Validating Event Parsing with Data Preview
18 Chapter 17: Manipulating Raw Data
17.1 Transformation Mechanics: props.conf & transforms.conf 17.2 Data Masking, Redaction & SEDCMD 17.3 Event Routing, Dynamic Index Assignment & Filtering to nullQueue
6.2 Other Authentication Options & Enabling Multifactor Authentication
Key Takeaways Explain This Topic AI
Besides native and LDAP, Splunk supports SAML 2.0 (Splunk as service provider), scripted authentication, ProxySSO, and authentication tokens.
SAML attributes default to role, realName, and mail; [authenticationResponseAttrMap_SAML] renames them and [roleMap_SAML] maps IdP groups to Splunk roles.
MFA is enabled with externalTwoFactorAuthVendor (Duo or RSA) and externalTwoFactorAuthSettings pointing to the vendor stanza in authentication.conf, or in Settings > Authentication Methods.
A Duo stanza needs apiHostname, integrationKey, and secretKey; failOpen defaults to false and universalPrompt to true.
Duo works with native, LDAP, and scripted authentication but not with SAML/SSO; Duo and RSA cannot be used at the same time.
Last updated: September 2026
- Other Authentication Options & Multifactor Authentication
- The Authentication Schemes Splunk Supports
authType in the [authentication] stanza of authentication.conf accepts Splunk (native, the default), LDAP , Scripted , SAML , and ProxySSO :
Scheme How it works Typical use
Native ( Splunk ) Users and SHA512-crypt password hashes in $SPLUNK_HOME/etc/passwd Small deployments, break-glass admin accounts
LDAP Binds to directory servers and maps groups (or users) to roles Active Directory / OpenLDAP integration
Scripted Splunk calls a script you supply (for example, getUserInfo functions) to authenticate against another system such as PAM or RADIUS Systems with no native Splunk integration
SAML 2.0 Splunk is the service provider; an identity provider (Okta, Microsoft Entra ID, PingFederate, AD FS) authenticates the user Enterprise single sign-on
ProxySSO A reverse proxy authenticates the user and passes the identity to Splunk Proxy-based SSO architectures
Authentication tokens Token-based authentication for REST and CLI access Automation and API clients
Native accounts always remain available alongside an external scheme. Splunk tries native authentication first. It moves on to LDAP only when the username does not exist locally, and on Splunk Enterprise it tries scripted authentication after that.
SAML 2.0 Integration & Federated Identity
Security Assertion Markup Language (SAML 2.0) enables federated Single Sign-On (SSO), allowing users to authenticate via enterprise identity providers such as Okta, Microsoft Entra ID (formerly Azure AD), or PingFederate.
SAML Architecture Roles
Service Provider (SP): The Splunk Enterprise Search Head hosting Splunk Web.
Identity Provider (IdP): The external corporate authentication server holding user credentials and executing authentication policies.
Metadata Exchange Architecture
Service Provider (SP) Metadata: Splunk generates an XML metadata document defining its unique entityId , the Assertion Consumer Service (ACS) URL ( https://<searchhead>:8000/saml/acs ), and and its single logout settings.
IdP Metadata: The administrator imports the IdP's metadata XML file into Splunk, providing the IdP Entity ID, IdP SSO Redirect URL, and the IdP's public X.509 signing certificate.
- SAML Stanza Configuration in authentication.conf [authentication]
- authType = SAML
- [saml]
- # Entity Identifiers
- entityId = splunk-prod-sh
- idpSSOUrl = https://login.microsoftonline.com/tenant-id/saml2
- idpSLOUrl = https://login.microsoftonline.com/tenant-id/slo
- # Cryptographic Certificates
- idpCertPath = $SPLUNK_HOME/etc/auth/idpCerts/idp_signing.pem
- signAuthnRequest = true
signedAssertion = true
- [authenticationResponseAttrMap_SAML]
- # Only needed when the IdP uses different attribute names than role/realName/mail
- role = http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
- realName = displayname
- mail = emailaddress
- [roleMap_SAML]
- admin = Azure_Splunk_Admins
- power = Azure_Splunk_PowerUsers
- user = Azure_All_Employees
- SAML Attribute Mapping
When a user authenticates at the IdP, the IdP sends an HTTP POST containing a cryptographically signed SAML assertion to the Splunk ACS URL. Splunk validates the assertion signature against idpCertPath and expects three attributes, named by default:
role : group values matched against [roleMap_SAML] to assign Splunk roles.
realName : the user's display name.
mail : the user's email address.
If your IdP sends different attribute names, map them in [authenticationResponseAttrMap_SAML] . When a SAML username collides with a native account, authTypePreferredForUserCollision (default Splunk ) decides whose roles apply.
Session Timeout Coordination
Administrators must coordinate two distinct session timeouts:
Splunk Web Session Timeout: Configured in web.conf under [settings] via tools.sessions.timeout = 60 (default 60 minutes).
IdP Session: Configured in the IdP. If the Splunk Web session expires while the IdP session is still valid, the SAML redirect usually signs the user back in without a password prompt.
Multifactor Authentication (MFA)
Splunk Enterprise supports two MFA vendors: Duo Security and RSA SecurID (RSA Authentication Manager) . You can use only one of them at a time. Duo works with native, LDAP, and scripted authentication. It is not compatible with SAML or other SSO methods . When users sign in through SAML, MFA is enforced by the identity provider.
Steps to Enable Duo MFA (blueprint 6.3)
In the Duo Admin Panel, protect Splunk as an application. Duo provides an integration key , a secret key , and an API hostname .
Enroll users and their devices in Duo; users need the Duo Mobile app or another supported Duo factor.
In Splunk Web on each instance that users log in to: Settings > Authentication Methods , then choose Duo Security under multifactor authentication and enter the values from Duo. You can instead configure authentication.conf as shown below.
Choose the failure behavior with failOpen (default false , so users are blocked if Duo cannot be reached) and a connection timeout .
Optionally enforce MFA on REST with enableMfaAuthRest = true . REST clients then need a session key obtained through a Duo-verified login.
Test with a non-admin account before rolling the change out.
- Duo Settings in authentication.conf [authentication]
- authType = LDAP
- authSettings = corp_active_directory
- externalTwoFactorAuthVendor = Duo
- externalTwoFactorAuthSettings = duo-mfa
- [duo-mfa]
- apiHostname = api-xxxxxxxx.duosecurity.com
- integrationKey = <20-character integration key>
- secretKey = <40-character secret key>
- appSecretKey = <40+ character locally generated key; required only when universalPrompt = false>
- universalPrompt = true
- failOpen = false
- timeout = 10
- enableMfaAuthRest = false
externalTwoFactorAuthVendor turns MFA on for the chosen vendor, and externalTwoFactorAuthSettings names the stanza that holds that vendor's settings.
Splunk obfuscates integrationKey , secretKey , and appSecretKey before saving them.
Universal Prompt is the default ( universalPrompt = true ). Duo has deprecated the Traditional Prompt, so Splunk tells older versions to upgrade and migrate.
The instance needs outbound HTTPS access to the Duo API hostname.
RSA SecurID
For RSA, set externalTwoFactorAuthVendor = RSA and configure the RSA stanza with values from RSA Authentication Manager, such as authManagerUrl (the REST endpoint) and accessKey . You can also set it up in Splunk Web under Settings > Authentication Methods .
Operational Troubleshooting & Diagnostic Reference
Issue Observed Root Cause Administrative Resolution
"Invalid credentials" on local admin login during IdP outage Attempting to log into standard Splunk Web URL which redirects to offline IdP Navigate explicitly to /en-US/account/login?loginType=splunk to display local form.
LDAP user cannot use Splunk after authenticating User does not belong to any group mapped in [roleMap_<strategy>] Check the user's groups in the directory and add the group mapping in Splunk Web or authentication.conf .
LDAP Bind failure: "error 49" in splunkd.log Service bind account password expired or entered incorrectly Update bindDNpassword in authentication.conf and restart or reload authentication.
Duo MFA fails for every user Instance cannot reach the Duo API hostname, keys are wrong, or the clock is badly skewed Check outbound HTTPS to the API host, re-enter the Duo keys, and keep NTP synchronized. With failOpen = false (the default), logins stay blocked until Duo is reachable.
SAML login fails with "Signature validation failed" IdP signing certificate expired or changed without updating Splunk Download updated X.509 PEM certificate from IdP and save to idpCertPath location.