Configuring RADIUS Authentication App¶

Below are the steps for configuring Splunk to use the RADIUS authentication app with a RADIUS server.

Configure Your RADIUS Server¶

Before you configure Splunk, you'll need to setup your RADIUS server per the vendor's documentation. See Configuring_IAS if you are using IAS for instructions.

Configure The RADIUS Authentication Splunk App (using the setup screen)¶

You'll need the following information from your RADIUS server in order to configure Splunk:

1. Shared secret
2. RADIUS server address
3. (optional) username and password of a valid account (so that you can verify the configuration before you save the settings)

Below are the steps to setup the app:

1. Install the RADIUS Authentication app
2. Open the setup app and configure the RADIUS authentication app (go to Manager » Apps » click "Set up" for the app "RADIUS Authentication"
3. Enter your RADIUS server settings and save the settings. Enter a sample user account in order to verify the configuration. The setup screen will not persist the settings if the test user account fails (which prevents saving a configuration that does not work).
4. Logout and test the configuration by logging into Splunk. Make sure to use an account that does not exist on the local Splunk install (accounts on the local Splunk install will still authenticate locally and thus will not test the RADIUS server configuration).

Configure The RADIUS Authentication Splunk App (manually)¶

The radius auth script can be configured manually by editing the file $SPLUNK_HOME/etc/system/local/authentication.conf with the following:

[radius_auth_script]
scriptPath = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/etc/apps/radius_auth/bin/radius_auth.py" 
scriptSearchFilters = 0

[authentication]
authType = Scripted
authSettings = radius_auth_script

Troubleshooting¶

You can view the logs from the RADIUS server app logs by searching logs matching the sourcetype "radius_auth" and "radius_auth_rest_handler":

index=_internal sourcetype="radius_auth" OR sourcetype="radius_auth_rest_handler" 

Alternatively, you can view the logs from Splunk itself as it attempts to use scripted authentication:

index=_internal sourcetype="splunkd" AuthenticationManagerScripted