topic Re: LDAP Authentication Splunk Free broken since update to Splunk 6 in Security

LDAP Authentication Splunk Free broken since update to Splunk 6

pixelseventy2 — Tue, 01 Oct 2013 10:06:07 GMT

Hi. I am currently running Splunk Free. In order to provide some access control, it is proxied through Apache on the same server, with LDAP authentication. This was working perfectly until I updated to Splunk 6 this morning. Now I am unable to access Splunk, as it keeps prompting for credentials. I've even tried changing to file-based passwords, with the same issue.

Here is my Apache config:

ProxyPass           /       htp://localhost:8000/ retry=0 timeout=5
ProxyPassReverse    /       htp://localhost:8000/

[Location /]
            AuthType Basic
            AuthName "Splunk"

            AuthBasicProvider ldap
            AuthzLDAPAuthoritative  On
            AuthLDAPBindDN "cn=ldap-bind,ou=Service Accounts,...,dc=co,dc=uk"
            AuthLDAPBindPassword "..."
            AuthLDAPUrl "ldap://10.10.10.10:389/ou=...,dc=co,dc=uk?sAMAccountName?sub?(objectClass=user)" NONE
            AuthLDAPGroupAttributeIsDN on

            Require ldap-group CN=G.ADM.Logging,OU=Admin,...DC=co,DC=uk
[/Location]

Has anyone else experienced this issue? If I disable authentication it proxies fine again.

(Note, the typos above are because I can't post otherwise.)
Thanks.

Re: LDAP Authentication Splunk Free broken since update to Splunk 6

Drainy — Tue, 01 Oct 2013 13:40:10 GMT

Are you saying that its now asking for a Splunk user/pass after passing your LDAP authentication?

Re: LDAP Authentication Splunk Free broken since update to Splunk 6

pixelseventy2 — Tue, 01 Oct 2013 16:00:07 GMT

Hi Drainy. No, it just keeps popping up the Apache basic authentication box, seemingly for each HTTP request.

Thanks.

Re: LDAP Authentication Splunk Free broken since update to Splunk 6

itghelp — Fri, 11 Oct 2013 22:33:23 GMT

I'm also experiencing this issue on 6. I had it on 5, but managed to mess with the proxy settings until it worked. Trying to login with the correct user/pass just results in the authentication prompt reopening. Hitting "cancel" just gives me a 401.

I'm using nginx to reverse proxy.

Re: LDAP Authentication Splunk Free broken since update to Splunk 6

pixelseventy2 — Tue, 15 Oct 2013 07:04:16 GMT

Hi @itghelp, are you seeing the issue on Chrome only, or on all browsers?

Thanks.

Re: LDAP Authentication Splunk Free broken since update to Splunk 6

itghelp — Tue, 15 Oct 2013 20:39:45 GMT

Hi @pixelseventy2, yes, only Chrome seems to be affected.

Re: LDAP Authentication Splunk Free broken since update to Splunk 6

ithangasamy_spl — Wed, 04 Dec 2013 18:36:35 GMT

it is known bug in 6.0 on Chrome .

Re: LDAP Authentication Splunk Free broken since update to Splunk 6

elatov — Sun, 08 Dec 2013 00:53:52 GMT

Are you referring to Chrome bug ID 6666?