topic Splunk Single Sign-On With F5 Big-IP in Security

Splunk Single Sign-On With F5 Big-IP

da7rutrak — Mon, 16 Dec 2013 23:21:43 GMT

I am curious if anyone has attempted to or is currently using an F5 Big-IP LTM as a reverse proxy for Splunk web. I've consulted Google U, but haven't been successful.

Re: Splunk Single Sign-On With F5 Big-IP

stemo76 — Fri, 10 Jan 2014 19:49:53 GMT

I too would like to know. We use an F5 to load level across 4 search heads. Would be nice to enable SSO.

Re: Splunk Single Sign-On With F5 Big-IP

alacercogitatus — Tue, 31 Mar 2015 01:09:03 GMT

If you are still interested in this - respond back - I've done it.

Re: Splunk Single Sign-On With F5 Big-IP

da7rutrak — Tue, 31 Mar 2015 02:20:10 GMT

@alacerogitatus - yes, still interested. I suspect it requires the ASM, but please share!

Re: Splunk Single Sign-On With F5 Big-IP

dandaily — Mon, 06 Apr 2015 15:28:55 GMT

I am very interested in this option. I have an F5 load balancer in front of my search head cluster., and I am looking to configure SSO.

Re: Splunk Single Sign-On With F5 Big-IP

kbaldwin — Wed, 08 Apr 2015 19:00:42 GMT

Interested as well. Getting ready to use F5 for SSO with a single search head and ultimately looking to have Splunk mobile traffic pass thru an F5 VS as well.

Re: Splunk Single Sign-On With F5 Big-IP

alacercogitatus — Fri, 10 Apr 2015 03:31:37 GMT

So apparently there is some interest in this. 😄

Here's how I have done it:

First - Setup Authentication to LDAP/AD in Splunk. Make Sure you have the right authorization settings.
Second - Setup The SSO configuration options in Splunk

SSOMode = permissive
trustedIP = <your-snat-pool-IPs>
remoteUser = <HEADER THAT CONTAINS USERNAME>

Third - Setup the F5 VIPs normally, with the Splunk Search heads as the pool. Using what ever SSO software you want (we used OAM), make sure you set the header that corresponds with the remoteUser setting.

Boom, done! There really is more than that, but this are the simplest steps I could think up.

Questions?

Re: Splunk Single Sign-On With F5 Big-IP

jkommeri — Fri, 22 Sep 2017 11:59:05 GMT

I am also interested in using Big-IP for the same purpose. Though, I am not a network expert. Can you elaborate this "Using what ever SSO software you want (we used OAM)" part a bit more?