As long as the Splunk software provide the ability for REMOTE_USER from a trusted source (i.e. proxy) within a company, it does not make any sense that Splunk Inc dictate that role information provided from the same trusted source not be used. It should be up to the company where Splunk is deployed to dictate how authentication is performed.
In our organization we use a well known reverse proxy product from IBM. If a user is correctly authenticated - the proxy will provide two HTTP headers for the back end services server (whatever these may be): One is HTTP header provides which contains the authenticated users, user name; the other is which contains a comma separated list of roles.
Splunk should, if the customer configures it that way, use the HTTP header where the roles are present.
Using scripted authentications creates CPU over head and complicate things, and using the same back end security storage that the web proxy is using might even not be possible for policy reasons.
