How are credentials passed in distributed search?

[Alan_Bradley]

What is the mechanism for federating credentials between splunk servers when doing a distributed search?

[gkanapathy]

In version 4.x, user credentials are not passed at all. Authentication between servers is performed, but the remote node completely trusts the search head (the node to which the user logged in) to appropriate restriction on the user and will serve all data that is asked of it.

The search head determines all roles, capabilities, and restrictions on the user, which are incorporated into the search. These will include search filters and index restrictions and defaults.

The search head will itself have to authenticate to the remote node. The remote node will have a public key for each search head that it trusts and will serve requests to. The search head must present and authenticate against that key. This trust is set up as part of the configuration of a distributed search pairing when the search head public key is copied to the remote node, and is why admin credentials for the remote node must be provided at the time the trust is established.

[matt · Accepted solution]

Probably best answered with an example: Say you have a distributed search environment with 3 servers: A / \ B C
- Users logs into serverA.
- The login is federated to serverB and serverC over SSL.
- If the login succeeds on serverB and serverC, auth token are sent back to serverA.
- The auth tokens are stored on serverA for the duration that the user is logged in on serverA.
- User performs a search on serverA. The auth token are attached to search, and the searches are federated to serverB and serverC over SSL.
- The results are returned from serverB and serverC to serverA over SSL and displayed.