topic Re: Splunk doesn't link SSO/HTTP Header ID to Splunk ID in Security

Splunk doesn't link SSO/HTTP Header ID to Splunk ID

tavandek — Wed, 27 Jul 2011 18:27:40 GMT

I have Splunk v4.2.2 configured for SSO using an external CAS gateway with an Apache reverse proxy.

I've had to set a remoteUser other than 'REMOTE_USER' to get this far, but it appears to be working/accepted to the point where Splunk isn't correlating the HTTP header remoteUser to the local splunk account.
I'm getting an error:
auth:56 - getSessionKey - unable to login; check credentials
decorators:192 - Could not authenticate user XXXXXXX via SSO. Does XXXXXXX have a matching splunk account with the same username?

I'm able to log into the Splunk port with the same local account, but logging in via the proxy/CAS server doesn't find the same local account for the userid that's being delivered in the Remote User HTTP Header.

The information in the debug/sso page all looks correct/accepted. Incoming request IP is trusted and the HTTP header/value for the remote user is correct.

I have no idea how to further debug this.
Is there a known fix for this, or a way to add any more details to the debug info via mrsparkle code?

Re: Splunk doesn't link SSO/HTTP Header ID to Splunk ID

tavandek — Thu, 28 Jul 2011 16:24:19 GMT

Found/fixed it.

trustedIP in the server.conf file was set to the server's ip address instead of 127.0.0.1, which is apparently what splunkd requires to do SSO validation.

This was separate/different from the trustedIP in the web.conf, which was being accepted.

splunkd.log displayed these errors, whereas web_service.log had displayed the previous trustedIP matching errors.

Re: Splunk doesn't link SSO/HTTP Header ID to Splunk ID

Dark_Ichigo — Fri, 07 Dec 2012 05:05:23 GMT

Thank you so much, this solved a great issue I was having, you wont believe how much trouble I went through....THANK YOU!!!!!!!

Re: Splunk doesn't link SSO/HTTP Header ID to Splunk ID

kaddupa1 — Mon, 11 Feb 2013 14:06:11 GMT

Awesome, thanks. That was the Problem i had as well 🙂

Re: Splunk doesn't link SSO/HTTP Header ID to Splunk ID

lukejadamec — Wed, 12 Jun 2013 19:54:33 GMT

Thank you very much.