Skip to main content
Lantern Home

 

Splunk Lantern

Preparing for Agent Management authentication changes in Splunk Enterprise 10.8

  1. Last updated
  2. Save as PDF

Splunk Enterprise 10.8 introduces a breaking change to communication between Agent Management (formerly known as Deployment Server) and deployment clients. Beginning with Splunk Enterprise 10.8, Agent Management default settings enforce deployment client authentication. This article explains what changed, who is affected, and how to prepare.

This change affects customers who use Agent Management without compatible authentication settings enabled.

Understanding the change

In Splunk Enterprise versions before 10.8, authentication is not required by default for deployment client communication with Agent Management. This can allow an unauthenticated party with network access to impersonate deployment clients or download application bundles, which might contain sensitive configuration information.

To address this risk, Splunk Enterprise 10.8 activates deployment client communication authentication by default. This is a breaking change because deployment clients that are not configured to authenticate might stop appearing in Agent Management and stop receiving new or updated applications after Agent Management is upgraded to 10.8. Default behavior for deployment clients has not changed.

The changes are made in two stanzas of $SPLUNK_HOME/etc/system/default/restmap.conf. The key setting is requireAuthentication=true in both stanzas:

[broker:broker]
match=/broker
authKeyStanza=deployment
requireAuthentication=true

[streams:deployment]
match=/streams/deployment
authKeyStanza=deployment
requireAuthentication=true

Configuring authentication

To prevent communication failures, configure pass4SymmKey for deployment clients and Agent Management. For detailed instructions, see Secure Splunk Enterprise services with pass4SymmKey.

Retaining unauthenticated communication

You can make changes to the $SPLUNK_HOME/etc/system/local/restmap.conf settings on the Agent Management node to retain unauthenticated communication. Set requireAuthentication=false in both stanzas:

[broker:broker]
match=/broker
authKeyStanza=deployment
requireAuthentication=false

[streams:deployment]
match=/streams/deployment
authKeyStanza=deployment
requireAuthentication=false

Retaining unauthenticated communication reintroduces the associated security risk. This is not recommended as a permanent solution.

Validating your configuration

Test an application deployment and review log files for authentication errors. If authentication is not correctly configured, you might see the following errors.

Deployment client — general communication authentication failure

$SPLUNK_HOME/var/log/splunk/splunkd.log

07-31-2026 12:14:32.107 +0000 INFO DC:DeploymentClient [7254 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
07-31-2026 12:14:32.107 +0000 INFO DC:PhonehomeThread [7254 PhonehomeThread] - Attempted handshake 10 times. Will try to re-subscribe to handshake reply
07-31-2026 12:14:36.580 +0000 WARN PubSubConnection [7253 HttpClientPollingThread_19898784-D6E4-4A94-A0E8-24044F92C656] - Cannot convert str: to a valid status, returning eRejected.

Deployment server — general communication authentication failure

$SPLUNK_HOME/var/log/splunk/splunkd_access.log

10.224.127.17 - - [31/Jul/2026:12:21:02.898 +0000] "POST /services/broker/connect/19898784-D6E4-4A94-A0E8-24044F92C656/ufw1/f798d4d49089/linux-x86_64/8089/10.4.0/19898784-D6E4-4A94-A0E8-24044F92C656/universal_forwarder/ufw1/tgz/none/none HTTP/1.1" 401 148 "-" "Splunk/10.4.0 (Linux 6.8.0-1040-aws; arch=x86_64)" - - - 0ms

Deployment client — application download authentication failure

$SPLUNK_HOME/var/log/splunk/splunkd.log

01-09-2026 12:34:56.789 +0000 WARN HTTPClient [1234 HttpClientPollingThread_12345678-ABCD-EF12-3456-78ABCDEF1234] - Download of file /opt/splunkforwarder/var/run/all/abcdef1234567890 failed with status 401
07-31-2026 09:42:19.876 +0000 WARN DeployedApplication [1234 HttpClientPollingThread_12345678-ABCD-EF12-3456-78ABCDEF1234] - Problem downloading from uri=ds1.my-domain.internal:8089 to path='/services/streams/deployment?name=default:my-serverclass:my-app'
07-31-2026 09:42:19.876 +0000 ERROR DeployedServerclass [1234 HttpClientPollingThread_12345678-ABCD-EF12-3456-78ABCDEF1234] - name=my-serverclass Failed to download app=my-app

Deployment server — application download authentication failure

$SPLUNK_HOME/var/log/splunk/splunkd_access.log

12.234.45.56 - - [01/Sep/2026:12:34:56.789 +0000] "POST /services/streams/deployment?name=default:my_serverclass:my_app HTTP/1.1" 401 130 "-" "Splunk/10.4.0 (Linux 6.8.0-1040-aws; arch=x86_64)" - - - 0ms

Next steps

You might find the following resources useful for implementing the guidance in this article: