topic Disable URL https://splunk:port/en-US/account/login?loginType=splunk in Security

Disable URL https://splunk:port/en-US/account/login?loginType=splunk

mielkea — Wed, 28 Apr 2021 18:27:22 GMT

Is there a way to allow the Splunk login only for the authtype!=Splunk. I know that I have to specify authtype=SAML or LDAP in the authentication.conf.
However, I don't want to have the option to call https://splunk:port/en-US/account/login?loginType=splunk.
We plan to set a rule in AWS on our LoadBalancer that will prevent access to splunk:port/en-US/account/login?loginType=splunk.
Is there another way to prevent loginType=splunk?

Re: Disable URL https://splunk:port/en-US/account/login?loginType=splunk

gcusello — Thu, 29 Apr 2021 06:34:30 GMT

hi @mielkea,

for my knowledge isn't possible to disable this way to access Splunk, but using this way you can use only local accounts, if you leave only admin account (disabling all other local accounts) and you put its credentials in a safe strongbox, you have the same result.

Ciao.

Giuseppe