• This protects Splunk with RSA Authentication Manager.
• Setting up the REST API as an authentication agent.
• The REST API is very useful as it doesn't restrict you to a specific code or programming language.

1. Navigate to Setup > System Settings > RSA SecurID Authentication API.
2. Check the box to Enable Authentication API.
3. Note the values for the Access Key.
4. You can change the value for the communication port number to any free port.

5. Add an agent entry in the Security Console:
6. Select Access > Authentication Agents > Add New.
7. Add the agent name.  Any name will do, but note that it will be used as the clientId in the requests below.
8. Login to the Splunk server.
9. Navigate to /opt/splunk/etc/apps/<app_name>/local/authentication.conf:

cd /opt/splunk/etc/apps/<APP_NAME>/local

10. The <app_name> shall be the application used by Splunk. (e.g. launcher)
11. In case of launcher, it will be as below:

    cd /opt/splunk/etc/apps/launcher/local

12. Edit the authentication.conf file:

    vi authentication.conf

13. Fill in the following: 

    [rsa-mfa] 
    accessKey = <Access_Key_From_Security_Console>
    authManagerUrl = https://<Primary_RSA_Server_Hostname>:5555/ 
    clientId = <Agent_Name_Created_Above> 
    enableMfaAuthRest = 1 
    failOpen = 0 
    replicateCertificates = 1 
    sslRootCAPath = <Mention__The_Path_to_RSA_Console_certificate> (eg. $SPLUNK_HOME/etc/auth/rsa-2fa/cert.pem)
    timeout = 15 
    [authentication] 
    externalTwoFactorAuthVendor = rsa 
    externalTwoFactorAuthSettings = rsa-mfa 

14. After making the above changes, save the configuration file:
    1. Press ESC then type :wq! then press Enter.
15. Finally, restart the Splunk server

    /opt/splunk/bin/splunk restart 
    

1. Navigate to the Security console 
2. Export the certificate Base-64 encoded X.509 (.CER)