topic Re: Passing credentials in Splunk URL in Security

Passing credentials in Splunk URL

pjsplunker — Tue, 19 Feb 2013 17:04:14 GMT

I am doing some load testing and need to pass uid and pwd in the Splunk URL. Generically, it looks like there are several ways to do it. Anyone have a sample that works ?

Thx..

Re: Passing credentials in Splunk URL

jonuwz — Tue, 19 Feb 2013 21:09:55 GMT

Create a setcion in etc/system/local/web.conf like this :

[settings]
enable_insecure_login = True

Restart splunk

Now you can log in directly with

http://splunk:8000/en-US/account/insecurelogin?username=admin&password=changeme

Re: Passing credentials in Splunk URL

pjsplunker — Tue, 19 Feb 2013 21:57:01 GMT

Awesome, thanks !

Re: Passing credentials in Splunk URL

smolcj — Wed, 20 Feb 2013 08:45:10 GMT

can i pass an external value along with this?
something like idno=12234
http://localhost:8000/en-US/account/insecurelogin?username=admin&password=smol&srno=777

Re: Passing credentials in Splunk URL

Ayn — Wed, 20 Feb 2013 08:55:38 GMT

Purpose being what?

Re: Passing credentials in Splunk URL

smolcj — Wed, 20 Feb 2013 11:53:42 GMT

some values from an external application bypassing splunk credentials. after reading this answer from jonuwz i think it will be a good idea when splunk is redirecting from some other applications with some values passing through the url.

Re: Passing credentials in Splunk URL

jonuwz — Mon, 28 Sep 2020 13:22:19 GMT

That is a terrible, terrible idea. Anyone looking at your source in the external app would be able to get splunk credentials.

i.e. I know your admin password is "smol"

and there's no use passing additional fields to the login screen. You probably want to re-direct it to a different page.

&return_to=%2Fen-GB%2Fapp%2Fmy_app%2Fmy_view

Re: Passing credentials in Splunk URL

jonuwz — Tue, 26 Feb 2013 22:08:44 GMT

You might want to accept this answer if it worked for you so that other people can find it

Re: Passing credentials in Splunk URL

thunder_wu — Thu, 25 Feb 2016 16:13:05 GMT

There is a valid case. I want to use it for my local splunk free installation and prototyping. This way do not have to type admin/admin every time.