topic Internet Explorer Login Fails in Security

Internet Explorer Login Fails

kmattern — Tue, 17 Aug 2010 02:25:56 GMT

This is a new one! I cannot log into Splunk using Internet Explorer. I could earlier today and I use IE 99% of the time. I also tried Google Chrome and had the same result. The fields are cleared, no message or anything else. I have totally rebooted my box to no avail. I also stopped and restarted Splunk. That didn't help either.

It works fine in FireFox.

Others in my organization are having the same problem and it began just today.

Version 4.0.11 Linux

What gives?

Re: Internet Explorer Login Fails

rotten — Tue, 17 Aug 2010 04:14:58 GMT

What authentication method are you using? Did your LDAP server go down? (Splunk doesn't automatically failover, you have to connect as the admin user and flip it if you have a preconfigured backup.)

We actually use an F5 between Splunk and our LDAP server, and we have a backup configuration preconfigured as well.

If you can't get into the Splunk UI at all, check out $SPLUNK_HOME/etc/system/local/authentication.conf to see how you are authenticating. You may need to temporarily move it out of the way, and bounce splunk, to revert to the default authentication method (local file).

If you are using a local file based authentication, is it possible you trashed it somehow? I believe you can hack $SPLUNK_HOME/etc/passwd to try to recover from such a disaster. Search around for "I forgot my admin password" for hints on how to recover it.

Re: Internet Explorer Login Fails

kmattern — Wed, 18 Aug 2010 18:54:02 GMT

Rotten,

I think you missed this sentence in my question:

"It works fine in FireFox."

Yes, I am using LDAP but cannot get in using the failsafe user id. But all user ids work fine in FireFox.

Something strange is going on.

Ken

Re: Internet Explorer Login Fails

rotten — Wed, 18 Aug 2010 20:25:55 GMT

Did you get a Flash upgrade? Are both IE and FF using the same version of Flash?

Re: Internet Explorer Login Fails

kmattern — Thu, 04 Nov 2010 20:25:15 GMT

I was required to set my forwarder to perpetually remain on a specific date. The computer I'm using to access Splunk had the current date. As soon as I changed the current date to be the same as the Splunk computer I was able to get in.