CODEWITHSUNDEEP
splunk
user84592
user84592

Reputation: 4882

Splunk: How to enable Splunk SSO

I have splunk and try to enable splunk SSO instead of nornal authentiation. I have configuraitons as follows:

In /opt/splunk/etc/system/local/server.conf

[general]
trustedIP = 192.168.1.208
serverName = Splunk_Core_02
pass4SymmKey = $7$RRvdYDdIlj4P2geQdtHluTRb7OfvZhTFTZGJ7z5JiZAkJ6Q1at6j0Q==
sessionTimeout = 30s

[sslConfig]
sslPassword = $7$m6pB5a0PWFg64VlNZGgunhGElO3qLiAc6NrhfLO+tpX2jR7WC7qm1Q==

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[license]
active_group = Enterprise

[diskUsage]
minFreeSpace = 1024

[lmpool:test_splunk]
quota = MAX
slaves = *
stack_id = enterprise

In /opt/splunk/etc/system/local/web.conf

[settings]
#SSO
SSOMode = permissive
trustedIP = 192.168.1.208,192.168.2.15,127.0.0.1
remoteUser = REMOTE-USER
#tools.proxy.on = False

root_endpoint = /splunk

#SSL
enableSplunkWebSSL = 0

httpport = 8000

mgmtHostPort = 127.0.0.1:8089

appServerPorts = 8065

splunkdConnectionTimeout = 30

enableSplunkWebClientNetloc = False

# SSL certificate files.
privKeyPath = $SPLUNK_HOME/etc/auth/splunkweb/privkey.pem
serverCert = $SPLUNK_HOME/etc/auth/splunkweb/cert.pem

...

I see http://192.168.1.208:8000/debug/sso page, I see SSO is not enabled. What's wrong with my configurations?

Upvotes: 0

Views: 610

Answers (3)

Amandeep Singh
Amandeep Singh

Reputation: 11

You have to use SAML.. I am using SAML for SSO purpose.. You need to contact IT guy and he will provide you IDP file upload it and share with your Splunk Connection file. You can download it from same window. Go to Users -> Authentication Method > SAML. Once everything is placed Then you have to create groups on AD and same thing you need to do on Splunk under SAML configuration.. Let me know if you need more details..

https://docs.splunk.com/Documentation/Splunk/8.0.3/Security/HowSAMLSSOworks

Upvotes: 0

Simon Duff
Simon Duff

Reputation: 2651

https://docs.splunk.com/Documentation/Splunk/8.0.3/Security/ConfigureSplunkSSO

Have you restarted splunk after making these changes?

In /opt/splunk/etc/system/local/web.conf, remoteUser = REMOTE-USER is more likley to be REMOTE_USER

Upvotes: 1

user84592
user84592

Reputation: 4882

There are several documentations says in server.conf, the trustedIP is 127.0.0.1. But none of them mention that only 127.0.0.1 is eligible to enable/activate SSO. So do not configure other IP address, instead of 127.0.0.1.

And in server.conf(/opt/splunk/etc/system/local/), you could only configure one trustedIP, and it is 127.0.0.1.

Upvotes: 3

Related Questions