Splunk Technology Add-on
TA-authid
Identity client
Free for personal use · commercial license required
Security
sssctl · klist · faillock
Why TA-authid exists
Login pain starts in the identity client, not the IdP. TA-authid watches SSSD, ticket expiry, faillock lockouts and domain reachability from each host so "I cannot log in" gets diagnosed instantly.
What it collects
- SSSD provider health
- Kerberos ticket lifetimes
- PAM faillock lockout patterns
- AD domain reachability
Runs on stock tools
No daemons, no agents, no exotic collectors - it shells out to well-known CLIs or reads sysfs, and parses the result into Splunk events.
External tools used: sssctl · klist · faillock.