Security

How are credentials passed in distributed search?

Alan_Bradley
Path Finder

What is the mechanism for federating credentials between splunk servers when doing a distributed search?

1 Solution

matt
Splunk Employee
Splunk Employee

Probably best answered with an example: Say you have a distributed search environment with 3 servers: A / \ B C
- Users logs into serverA.
- The login is federated to serverB and serverC over SSL.
- If the login succeeds on serverB and serverC, auth token are sent back to serverA.
- The auth tokens are stored on serverA for the duration that the user is logged in on serverA.
- User performs a search on serverA. The auth token are attached to search, and the searches are federated to serverB and serverC over SSL.
- The results are returned from serverB and serverC to serverA over SSL and displayed.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

In version 4.x, user credentials are not passed at all. Authentication between servers is performed, but the remote node completely trusts the search head (the node to which the user logged in) to appropriate restriction on the user and will serve all data that is asked of it.

The search head determines all roles, capabilities, and restrictions on the user, which are incorporated into the search. These will include search filters and index restrictions and defaults.

The search head will itself have to authenticate to the remote node. The remote node will have a public key for each search head that it trusts and will serve requests to. The search head must present and authenticate against that key. This trust is set up as part of the configuration of a distributed search pairing when the search head public key is copied to the remote node, and is why admin credentials for the remote node must be provided at the time the trust is established.

matt
Splunk Employee
Splunk Employee

Probably best answered with an example: Say you have a distributed search environment with 3 servers: A / \ B C
- Users logs into serverA.
- The login is federated to serverB and serverC over SSL.
- If the login succeeds on serverB and serverC, auth token are sent back to serverA.
- The auth tokens are stored on serverA for the duration that the user is logged in on serverA.
- User performs a search on serverA. The auth token are attached to search, and the searches are federated to serverB and serverC over SSL.
- The results are returned from serverB and serverC to serverA over SSL and displayed.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...