Create the authentication script

To integrate your authentication system with your Splunk deployment, make sure the authentication system is running and then do the following:

1. Create a Python authentication script. See "Create a Python script" in this topic for the procedure.

2. Test the new script. See "Test the script" in this topic for the procedure.

3. Enable your script by editing authentication.conf to specify scripted authentication and associated settings. See "Edit authentication.conf" for the procedure.

Splunk Cloud Platform doesn't support scripted authentication.

Create a Python script

You must create a Python script that implements these authentication functions:

userLogin
getUserInfo
getUsers

The Splunk server will call these functions as necessary, either to authenticate user login or to obtain information on a user's roles.

The script can optionally also include a handler for this function:

getSearchFilter

This table summarizes the authentication functions, their arguments, and their return values:

Function	Description	Argument string	Return value string
`userLogin`	Login with user credentials.	`--username=<username>` `--password=<password>` (values passed one per line over `stdin`)	fail (safely passed over `stdout`)
`getUserInfo`	Return a user's information, including name and role(s).	`--username=<username>`	--status=success\|fail --userInfo=<userId>;<username>;<realname>;<roles> Note the following: `userInfo` must specify a semicolon-delimited list. `<userId>` is deprecated; you should return just the associated semicolon. `<username>` is required. `<realname>` is optional, but its semicolon is required. `<roles>` is required. To return multiple roles, use colons to separate the roles. For example: `admin:power` This example returns just the roles for a user named "docsplunk": `--status=success --userInfo=;docsplunk;;admin:power`
`getUsers`	Return information for all Splunk users.	none	--status=success\|fail --userInfo=<userId>;<username>;<realname>;<roles> --userInfo=<userId>;<username>;<realname>;<roles> --userInfo=<userId>;<username>;<realname>;<roles> ... Note the following: See `getUserInfo` for information on the syntax to use to return each user's information. Separate each user's information with a space. `<roles>` is required. To return multiple roles, use colons to separate the roles. For example: `admin:power`
`getSearchFilter`	Optional. Returns the filters applied specifically to this user, along with those applied to the user's roles. The filters are OR'd together.	`--username=<username>`	--status=success\|fail --search_filter=<filter> --search_filter=<filter> ... Note: User-based search filters are optional and not recommended. A better approach is to assign search filters to roles and then assign users to the appropriate roles. For more information, see "Use the getSearchFilter function to filter at search time"

See the example scripts for detailed information on how to implement these functions.

Test the script

Since the communication between your Splunk deployment and the script occurs via stdin and stdout, you can test the script interactively in your command shell. Be sure to send one argument per line and end each function call with an EOF (Ctrl-D).

Test each function individually, using this pattern:

> python [script] [function name]
[pass arguments here, one per line]
[send eof, with Ctrl-D]
[output appears here, check that it's correct]
>

The following example shows a debugging session that does some simple testing of a fictional script called "example.py", with two users "alice" and "bob". "alice" is a member of the "admin" and "super" roles, and "bob" is a member of the "user" role.

> python example.py userLogin
--username=alice
--password=correctpassword
<send an EOF>
--status=success
> python example.py userLogin
--username=bob
--password=wrongpassword
<send an EOF>
--status=fail
> python example.py getUsers
<no arguments for this function, send an EOF> 
--status=success --userInfo=bob;bob;bob;user --userInfo=alice;alice;alice;admin:super
> python example.py getUserInfo
--username=bob
<send an EOF>
--status=success --userInfo=bob;bob;bob;user
> python example.py getUserInfo
--username=userdoesnotexist
<send an EOF>
--status=fail
>

Important: This is just an example of how to go about testing a script. It does not attempt to perform exhaustive debugging of any real script.

Related answers from Splunk Community

Create the authentication script

Create a Python script

Test the script

Comments

Create the authentication script

Was this topic useful?