SPLK-1003 · Domain 6 of 17

SPLK-1003 Domain 6: Splunk Authentication Management

Authentication Management covers how Splunk verifies users: connecting to LDAP and mapping groups to roles, choosing among SAML, scripted and native options, and adding multifactor authentication through supported providers.

Exam weight
5%
Official objectives
3
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 9 min read Reviewed October 2026

Overview

Domain 6 has three official objectives: integrate Splunk with LDAP, list other user authentication options, and describe the steps to enable multifactor authentication in Splunk. LDAP integration means defining an LDAP strategy with connection details, user and group search settings, and a mapping of directory groups to Splunk roles. Other options include native Splunk accounts, SAML 2.0 single sign-on with an identity provider such as Microsoft Entra ID or Okta, scripted authentication for systems like RADIUS or PAM, and ProxySSO.

MFA is configured through supported vendors, Duo Security and RSA, and applies on top of the primary authentication method. At 5%, expect about three questions, typically on LDAP configuration fields, group-to-role mapping and how native and external accounts interact.

How it's tested

Questions describe an organisation's identity setup and ask which Splunk configuration or step makes it work, or they present an authentication problem such as users who cannot log in and ask for the cause. Field names and the order of steps matter more than theory here.

  • Configure LDAP

    You choose the fields, such as bind DN, user base DN or group mapping, needed to connect Splunk to a directory.

  • Pick the method

    An identity requirement such as SSO or RADIUS is described and you select SAML, scripted or native authentication.

  • MFA steps

    You order the steps for adding Duo or RSA multifactor authentication or identify the supported vendors.

Reasoning it through

Users in an LDAP group can bind successfully but are refused access to Splunk. The candidate checks the strategy and sees no role mapping for that group. In Splunk, an LDAP user can only log in if at least one of their groups maps to a Splunk role. Adding the mapping, rather than creating native accounts, solves the problem.

Objectives 3

Official objectives from the Splunk outline, in outline order.

6.1 Integrate Splunk with LDAPLDAP strategies, connection settings and role mapping.
What it means
Splunk can authenticate users against LDAP directories such as Active Directory or OpenLDAP. An admin creates an LDAP strategy in Settings, Authentication methods or in authentication.conf, entering the host, port, SSL choice, bind DN and password, user base DN, user name attribute, group base DN and group membership attributes. Directory groups are then mapped to Splunk roles.
What to understand
A user must belong to a group mapped to at least one role to log in. Several strategies can be configured and ordered. Port 389 is standard LDAP and 636 is LDAP over SSL. Splunk caches LDAP user information, and you can reload authentication rather than restart after changes. Native accounts with the same name take precedence over LDAP accounts.
How it shows up
An LDAP integration problem or requirement is described and you choose the missing setting or step.
Common confusion
Assuming successful binding alone lets users log in without group-to-role mapping.
6.2 List other user authentication optionsNative, SAML, scripted and ProxySSO authentication.
What it means
Besides LDAP, Splunk supports native Splunk authentication, SAML 2.0 single sign-on through an identity provider such as Microsoft Entra ID, Okta, Ping or AD FS, scripted authentication that calls an external script for systems like RADIUS or PAM, and ProxySSO through a trusted reverse proxy.
What to understand
SAML maps identity provider attributes or groups to Splunk roles and is the common choice for SSO. Scripted authentication is flexible but needs a script that implements Splunk's required functions. Native authentication is always available and remains useful for emergency admin access when external systems fail.
How it shows up
A requirement such as single sign-on or RADIUS is given and you pick the matching method.
Common confusion
Choosing LDAP when the requirement is browser-based single sign-on, which SAML provides.
6.3 Describe the steps to enable multifactor authentication in SplunkDuo and RSA MFA configuration.
What it means
Splunk Enterprise supports multifactor authentication through Duo Security and RSA. For Duo, an admin creates an application in the Duo admin panel to get an integration key, secret key and API hostname, then enters them under Settings, Authentication methods, Multifactor authentication in Splunk. RSA uses an RSA Authentication Manager configuration with its own REST settings and certificates.
What to understand
MFA is added on top of native, LDAP or SAML login rather than replacing it. Test with a non-admin account and keep a recovery path so a provider outage does not lock out administrators. MFA for CLI and REST access needs additional settings.
How it shows up
You order MFA configuration steps or identify which providers Splunk supports natively.
Common confusion
Thinking MFA replaces LDAP or SAML instead of adding a second factor after primary login.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • LDAP strategy

    A named set of LDAP connection and mapping settings.

    Remember
    Several strategies can be ordered.
    Tested as
    LDAP configuration items.
    Trap
    Assuming only one directory is allowed.

  • Bind DN

    The account Splunk uses to query the directory.

    Remember
    Needs read access to users and groups.
    Tested as
    Connection questions.
    Trap
    Using the end user's DN.

  • User base DN

    Where Splunk searches for user entries.

    Remember
    Separate from the group base DN.
    Tested as
    Field identification items.
    Trap
    Swapping user and group base DNs.

  • Group-to-role mapping

    Links directory groups to Splunk roles.

    Remember
    Users need at least one mapped group to log in.
    Tested as
    Login failure scenarios.
    Trap
    Expecting unmapped users to get a default role.

  • Ports 389 and 636

    Standard LDAP and LDAP over SSL.

    Remember
    Choose SSL to protect bind credentials.
    Tested as
    Connection questions.
    Trap
    Using 636 without enabling SSL.

  • Native precedence

    Native Splunk accounts win over external accounts of the same name.

    Remember
    Keep a native admin for emergencies.
    Tested as
    Conflict questions.
    Trap
    Assuming LDAP overrides native.

  • SAML 2.0

    Single sign-on through an identity provider.

    Remember
    Maps assertions or groups to roles.
    Tested as
    SSO questions.
    Trap
    Choosing LDAP for SSO.

  • Scripted authentication

    Uses an external script, for example for RADIUS or PAM.

    Remember
    Script must implement Splunk's functions.
    Tested as
    Method selection items.
    Trap
    Thinking it is built-in RADIUS support.

  • Duo and RSA

    The MFA vendors Splunk Enterprise supports natively.

    Remember
    Duo needs integration key, secret key and API host.
    Tested as
    MFA step questions.
    Trap
    Listing unsupported vendors.

  • authentication.conf

    File holding authentication settings and role maps.

    Remember
    Roles themselves are in authorize.conf.
    Tested as
    File location items.
    Trap
    Mixing it up with authorize.conf.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Authentication methods

ConceptMeaningKey differenceCommon trap
Native Accounts stored in Splunk Always available, takes precedence Forgetting emergency use
LDAP Directory-based login Group-to-role mapping Expecting SSO
SAML Single sign-on via IdP Browser redirects to IdP Choosing LDAP for SSO
Scripted Custom external script Supports RADIUS or PAM Assuming built-in RADIUS

LDAP settings

ConceptMeaningKey differenceCommon trap
Bind DN Service account for queries Splunk's identity Using a user's DN
User base DN Location of user entries User search scope Swapping with group base
Group base DN Location of group entries Group search scope Leaving it blank

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Bind means login

    What candidates pick
    Assume users can log in once the LDAP bind succeeds.
    Why it looks right
    The connection test passes.
    Why it's wrong
    Users also need membership in a group mapped to a Splunk role.

    Clue to watch for Users authenticate but are refused access.

  2. LDAP for SSO

    What candidates pick
    Choose LDAP to give users single sign-on.
    Why it looks right
    LDAP is the familiar directory option.
    Why it's wrong
    Single sign-on through an identity provider uses SAML 2.0.

    Clue to watch for The requirement mentions SSO or an IdP.

  3. LDAP wins conflicts

    What candidates pick
    Expect the LDAP password to apply for a duplicate username.
    Why it looks right
    The directory feels authoritative.
    Why it's wrong
    Splunk checks native accounts first, so the native account takes precedence.

    Clue to watch for A native and LDAP user share a name.

  4. Any MFA vendor

    What candidates pick
    Pick a generic authenticator app integration.
    Why it looks right
    Many products offer MFA.
    Why it's wrong
    Splunk Enterprise natively supports Duo Security and RSA for MFA.

    Clue to watch for The question asks which providers are supported.

  5. Roles in authentication.conf

    What candidates pick
    Define role capabilities in authentication.conf.
    Why it looks right
    The file handles group mapping.
    Why it's wrong
    Role capabilities live in authorize.conf; authentication.conf maps groups to them.

    Clue to watch for The task is changing what a role can do.

Answer framework

Apply these steps to authentication scenarios before picking an answer.

  1. Identify the identity source and requirement, such as a directory, single sign-on through an identity provider, RADIUS or local accounts only.
  2. Choose the method: LDAP for directories, SAML for SSO, scripted for RADIUS or PAM, and native for local or emergency accounts.
  3. For LDAP, check host, port and SSL, bind credentials, user and group base DNs and the attributes used for names and membership.
  4. Confirm each group that needs access is mapped to a Splunk role, and check for native accounts with clashing usernames.
  5. If a second factor is required, add Duo or RSA multifactor authentication on top and keep an emergency access path.

Practice question

An admin configures an LDAP strategy for Active Directory. The connection test succeeds and users enter correct passwords, but every login is rejected. What is the most likely missing step?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Organise this topic around one diagram: an identity source on the left, Splunk's authentication method in the middle and Splunk roles on the right. Fill in LDAP, SAML, scripted and native as the possible middle boxes and write what each needs to work. Most questions reduce to finding which box or arrow is missing.

If you have access to a test directory, configure an LDAP strategy and map a group to a role, then log in as a directory user. Otherwise, open Settings, Authentication methods and walk through the LDAP and SAML forms so the field names are familiar. Read authentication.conf afterwards to see how the settings are stored.

For MFA, read the Duo setup steps in Splunk's documentation and memorise the three values Duo provides. Then practise scenarios about failed logins and conflicting accounts. Keep the time spent proportional to the 5% weight, but make sure LDAP field names and role mapping are solid, since they produce most of the questions.

FAQ

How much of SPLK-1003 is Splunk Authentication Management?

Splunk Authentication Management is 5% of the exam, about three questions, covering LDAP, other authentication options and MFA.

Why can't my LDAP users log in?

The most common cause is a missing group-to-role mapping. Users must belong to at least one group mapped to a Splunk role.

Which authentication options does Splunk support besides LDAP?

Native Splunk accounts, SAML 2.0 single sign-on, scripted authentication for systems such as RADIUS or PAM, and ProxySSO.

Which MFA vendors are supported?

Splunk Enterprise supports Duo Security and RSA for multifactor authentication.

What happens if a native and LDAP user share a name?

The native Splunk account takes precedence, so the native password and roles apply.

Where are authentication settings stored?

In authentication.conf, which holds strategies and role mappings. Role capabilities themselves are defined in authorize.conf.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

You have covered LDAP integration, other authentication methods and MFA. Test whether you can diagnose login problems and choose the right method.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going