A customer is using both internal Splunk authentication and LDAP for user management. If a username exists in both $SPLUNK_HOME/etc/passwd and LDAP, which of the following statements is accurate?

Question

Options

• AThe internal Splunk authentication will take precedence.
• BAuthentication will only succeed if the password is the same in both systems.
• CThe LDAP user account will take precedence.
• DSplunk will error as it does not support overlapping usernames

• A
  92% (34)
• B
  5% (2)
• D
  3% (1)

Explanation

When a username exists in both Splunk's internal $SPLUNK_HOME/etc/passwd file and an LDAP directory, internal Splunk authentication always wins - Splunk checks its native password store first and stops there if it finds a match, regardless of what LDAP says.

Why the distractors are wrong:

• B is wrong because Splunk doesn't compare or synchronize passwords across authentication systems - it simply stops at the first match.
• C is wrong because LDAP is only consulted if the user is not found in the internal store; the internal store has higher priority.
• D is wrong because Splunk handles overlapping usernames gracefully by design - it uses a defined priority order rather than throwing an error.

Memory tip: Think of it as a "local before remote" rule - just like a local /etc/passwd on a Linux system takes precedence over network directory services, Splunk's own passwd file is checked before any external authentication provider (LDAP, AD, SAML, etc.).

No community discussion yet for this question.