How often does Splunk recheck the LDAP server?

The correct answer is B. Each time a user logs in. Splunk rechecks the LDAP server each time a user logs in (B). When a user authenticates, Splunk queries the LDAP/Active Directory server to verify credentials and retrieve current group memberships. This real-time per-login check ensures that changes to user accounts or group mem

Users and Roles

Question

Options

AEvery 5 minutes
BEach time a user logs in
CEach time Splunk is restarted
DVaries based on LDAP_refresh setting.

How the community answered

(33 responses)

A
3% (1)
B
91% (30)
D
6% (2)

Explanation

Splunk rechecks the LDAP server each time a user logs in (B). When a user authenticates, Splunk queries the LDAP/Active Directory server to verify credentials and retrieve current group memberships. This real-time per-login check ensures that changes to user accounts or group memberships in LDAP are reflected immediately upon the user's next login - there is no fixed polling interval. This means if a user is removed from an LDAP group that grants Splunk access, the change takes effect at their very next login attempt. There is no background polling or scheduled recheck independent of login events.

Topics

#LDAP#Authentication#User management#authentication.conf

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice