A customer wants to migrate from using Splunk local accounts to use Active Directory with LDAP for their Splunk user accounts instead. Which…

Splunk stores all information required to reach and bind to an external LDAP directory—server URI, bind DN, SSL settings, search bases, group-mapping, etc.—in authentication.conf. No other .conf file is required for establishing or maintaining the LDAP connection; authorize.conf is only needed when you define custom roles or capabilities and ldap.conf does not exist in Splunk. Therefore, to “connect to an Active Directory LDAP provider” you must modify authentication.conf only.

A. authentication.conf, authorize.conf, ldap.conf – authorize.conf not required for connectivity; ldap.conf is not a Splunk file.

B. authentication.conf, ldap.conf – ldap.conf is not used or recognized by Splunk.

D. authorize.conf, authentication.conf – authorize.conf unnecessary for establishing the LDAP connection itself.

1. Splunk Enterprise Admin Manual, “Configure LDAP authentication with Splunk Enterprise,” Steps 2-4: “Edit $SPLUNKHOME/etc/system/local/authentication.conf … this file contains all LDAP connection information.” (Splunk Docs v9.1, Admin Manual, ldap-authentication.html)

2. Splunk Enterprise Admin Manual, “authorize.conf – role configuration file,” first paragraph: “authorize.conf defines roles and capabilities; it does not handle authentication or directory connections.” (Splunk Docs v9.1, authorizeconf.html)