topic Re: Splunk ProxySSO – Logout or session time-out redirection not working as expected in Security

Splunk ProxySSO – Logout or session time-out redirection not working as expected

pbadhe_2 — Mon, 02 Dec 2019 12:17:18 GMT

We have a Splunk cluster setup configured to use ProxySSO. Our LB is playing role of Proxy server and it passes all the required credentials, group Info, user identity etc. to the Splunk Web through HTTP headers. After getting this information Splunk properly authenticates and displays expected dashboards using appropriate authorization.

The issue comes when user either clicks the Logout option of Splunk OR session timeout happen due to in-activity. The expectation is - Splunk should redirect to the URL as configured in Proxy server but actually the redirection doesn’t work and after logging out the Splunk Login page is displayed. Proxy server URL is configured to property redirectAfterLogoutToUrl under [ssosettings] stanza. But its not working. We want to redirect the user to a separate page but ends up in displaying Splunk Login page.

How to configure this with ProxySSO authentication method?

Thanks

Re: Splunk ProxySSO – Logout or session time-out redirection not working as expected

pbadhe_2 — Wed, 30 Sep 2020 03:10:43 GMT

Here are the configurations I am using:
web.conf
[root@searchead01 local]# cat web.conf
[settings]
updateCheckerBaseURL = 0
enableSplunkWebSSL = true
splunkdConnectionTimeout = 10800
sslVersions = *,-ssl2,-ssl3,-tls1.0,-tls1.1
cipherSuite = TLSv1.2:!eNULL:!aNULL
ecdhCurves = prime256v1,secp384r1,secp521r1
dhFile = /opt/splunk/etc/auth/splunkweb/dh2048.pem
allowSslCompression = false
enableWebDebug = true
x_frame_options_sameorigin = False
remoteUser = REMOTE_USER
remoteGroups = REMOTE_GROUPS
remoteUserMatchExact = 0
remoteGroupsMatchExact = 0
SSOMode = strict
trustedIP = 127.0.0.1,10.20.30.40

authentication.conf
[root@searchhead01 local]# cat authentication.conf
[authentication]
authType = ProxySSO
authSettings = ssosettings

[ssosettings]

idpSLOUrl = https://Path/To/Custom/logout.html

redirectAfterLogoutToUrl = https://Path/To/Custom/logout.html

[roleMap_proxySSO]
splunkrole1 = cn=activedirectorygroup1
splunkrole2 = cn=activedirectorygroup2
splunkrole3 = cn=activedirectorygroup3