• Configuring RADIUS Authentication App
  • Configure Your RADIUS Server
  • Configure The RADIUS Authentication Splunk App (using the setup screen)
  • Configure The RADIUS Authentication Splunk App (manually)
  • Troubleshooting
    • User Accounts from the RADIUS Server Cannot Log In
    • Roles are Not Being Loaded from the RADIUS Server
    • Splunk is Still Using the Credentials from my Local Account
    • Authentication Test on Setup Screen Fails Indicating "Unable to validate credentials against the server ..."

Configuring RADIUS Authentication App¶

Below are the steps for configuring Splunk to use the RADIUS authentication app with a RADIUS server.

Configure Your RADIUS Server¶

Before you configure Splunk, you'll need to setup your RADIUS server per the vendor's documentation. See Configuring_IAS if you are using IAS for instructions.

The RADIUS authentication app will load roles from the RADIUS server if you set up an attribute containing a comma or colon list of roles. You'll need to configure the RADIUS authentication app to tell it which attribute it ought to us to find the roles. See Configuring_Roles for more information.

Configure The RADIUS Authentication Splunk App (using the setup screen)¶

You'll need the following information from your RADIUS server in order to configure Splunk:

1. Shared secret
2. RADIUS server address
3. (optional) username and password of a valid account (so that you can verify the configuration before you save the settings)
4. (optional) the vendor code and attribute ID if loading roles from the RADIUS server

Below are the steps to setup the app:

1. Install the RADIUS Authentication app
2. Open the setup app and configure the RADIUS authentication app (go to Manager » Apps » click "Set up" for the app "RADIUS Authentication"
3. Enter your RADIUS server settings and save the settings. Enter a sample user account in order to verify the configuration. The setup screen will not persist the settings if the test user account fails (which prevents saving a configuration that does not work).
4. Logout and test the configuration by logging into Splunk. Make sure to use an account that does not exist on the local Splunk install (accounts on the local Splunk install will still authenticate locally and thus will not test the RADIUS server configuration).

Configure The RADIUS Authentication Splunk App (manually)¶

The radius auth script can be configured manually by editing the file $SPLUNK_HOME/etc/system/local/authentication.conf with the following:

[radius_auth_script]
scriptPath = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/etc/apps/radius_auth/bin/radius_auth.py" 
scriptSearchFilters = 0

[authentication]
authType = Scripted
authSettings = radius_auth_script

Troubleshooting¶

User Accounts from the RADIUS Server Cannot Log In¶

This can be due to a number of issues. View the related logs with the following search to determine why users cannot log in:

index=_internal ( (UserManagerPro OR HTTPAuthManager) AND sourcetype="splunkd" ) OR sourcetype="radius_auth*" 

Roles are Not Being Loaded from the RADIUS Server¶

Incorrect vendor code or attribute ID is the most common reasons for roles not being loaded from the RADIUS server. Use the following search to view the attributes that are loaded when a user successfully authenticates (note that you will need to successfully login using a RADIUS server user to see the attributes):

index=_internal "Received the following fields upon login" sourcetype="radius_auth" 

Splunk is Still Using the Credentials from my Local Account¶

Users will be authenticated via RADIUS unless they have a local account. Splunk gives local accounts priority over scripted auth users and therefore will not use RADIUS for accounts where a local account already exists.

Authentication Test on Setup Screen Fails Indicating "Unable to validate credentials against the server ..."¶

The logs likely provide more details regarding why the authentication attempt failed. You can see the relevant logs by searching for the sourcetype "radius_auth" in the internal index:

index=_internal sourcetype="radius_auth"

The log message will probably look something like "Exception triggered when attempting to contact the RADIUS server" and should include details regarding why the authentication attempt failed.