Access and roles Flashcards
What authentication methods does Splunk support?
- Built-in
- LDAP
- Multifactor authentication
- SSO
- Scripted authentication
What is the most common authentication method?
LDAP with Active Directory
In case there are two LDAPs configured, which one gets priority?
The first one in the list
List SSO options
SSO can be implemented with:
- reverse proxy
- proxy
- SAML
List 4 SAML options
CA Siteminder, Okta, Ping Identity, Azure AD
Give two examples for a scripted authentication?
RADIUS or PAM
Where is Splunk internals authentication placed?
/etc/passwd
What is the difference between authentication and authorization, give examples.
authentication. conf describes the way the user gets authenticated (who are you and are you allowed to come in). Eg LDAP with AD configuration.
authorization. conf describes what the granted user can do, eg which indexes can be accessed.
A customer wants to implement LDAP with AD, does he need to work on authentication.conf or authorization.conf?
authentication.conf
What Authentication method always takes precedence when multiple methods are configured?
Built-in
In LDAP, what is a OU?
Organizational Unit
ex. ou=people, dc=splunk, dc=com
What can you ask for from a system administrator to help with configuring Splunk with LDAP?
LDAP Data Interchange Format(LDIF)
This will allow you to review all of the attribute/value pairs associated with each and more identify things such as the “Base DN for users” and the “Base DN for groups”
How does authorization work in Splunk?
- In order for a user to login they must have a User Account and A ROLE assigned.
- Cannot assign Access/Capabilities to a user. They must be assigned to Roles.
- Roles can only Assign Capabilites, Not Remove them.
- Rest API Data Access Query
https: //host:port/services/authorization/roles/admin - To faithfully restrict access to data it must be in its own index, and restricted from there. Search time obfuscation can be subverted
- Create separate indexes for data with diffferent classifications, and User access levels
- Default User Role has access to all Non-Internal indexes
If there are SSO or SAML problems and the login is not possible, what is your option?
Add to the login URI:
?login_type=splunk
What is Role?
A collection of permissions and capabilities
A role is a handle for linking together access rights and capabilities
Cannot assign access/capabiltiies to a user. These must be assigned to roles. If a particular individual needs a specific capability or access, then a role must be created for that user, making it a role of one.
