topic Re: Bypassing Splunk Authentication to load dashboards in Security

Bypassing Splunk Authentication to load dashboards

Arun_N_007 — Thu, 05 Jan 2017 09:22:18 GMT

Hi,

I would like to embed Splunk as an iframe in my we application. Here we need to load Splunk dashboard on load of the page bypassing its authentication.

Here Authentication will be done for that user in third party system while logging in to my web app.

Here am not talking about the insecure login which passes password in the header. Can i use HTTP POST for insecure login? If yes then how?

Regards,
Arun

Re: Bypassing Splunk Authentication to load dashboards

renjith_nair — Thu, 05 Jan 2017 09:56:53 GMT

One of the way's is using the embed report functionality of Splunk. This does not need any authorization and can open in any html.

https://docs.splunk.com/Documentation/Splunk/6.5.1/Report/Embedscheduledreports

Re: Bypassing Splunk Authentication to load dashboards

Arun_N_007 — Thu, 05 Jan 2017 10:01:06 GMT

No embed report got some limitations like...

No real time search
Report should be pre populated and should be loaded with saved searches.

I need to show my
Splunk dashboard UI in an iframe.

Re: Bypassing Splunk Authentication to load dashboards

gcusello — Tue, 29 Sep 2020 12:16:05 GMT

Hi Arun_N_007,
this is possible if Splunk is configured for integration with Active Directory: it's possible to configure browser to execute automatic login using users account for authentication.
In othe words: user does logon to AD domain when open his own computer ( “joined” to the domain).
When user will connect to Splunk using own browser (configured as described in the following URL), he will not have to type his credentials again.
https://prdsoftware.com/helpmasterlive/KnowledgeBase/kbarticle.aspx?view=107

Obviously this functionality runs only with a Splunk Enterprise License, it doesn't run with a free license.

Bye.
Giuseppe

Re: Bypassing Splunk Authentication to load dashboards

Arun_N_007 — Thu, 05 Jan 2017 10:12:15 GMT

Here am not using AD... I need authentication done by system specific to our product and Splunk should let me in.

Can we use external scripts to achieve this? And here we want to pass only username and Web session id here... Which can be validated in script to let me in Splunk.

Re: Bypassing Splunk Authentication to load dashboards

gcusello — Thu, 05 Jan 2017 12:03:56 GMT

We have always AD, I don't know other ways.
Sorry.
bye.
Giuseppe

Re: Bypassing Splunk Authentication to load dashboards

sjohnson_splunk — Thu, 05 Jan 2017 13:37:36 GMT

Scripted authentication is supported. You should look at the authentication.conf.spec file.

There are also samples of scripts located at: $SPLUNK_HOME/share/splunk/authScriptSamples

Re: Bypassing Splunk Authentication to load dashboards

surekhasplunk — Mon, 22 Jan 2018 20:34:40 GMT

Hi @cusello,

Could you please activate the link https://prdsoftware.com/helpmasterlive/KnowledgeBase/kbarticle.aspx?view=107 as i cant find any details in that page.
My scenario is my users are AD enabled and i want to bypass the login screen of splunk and show them the default dashboard as per their roles.
Pls help.

Re: Bypassing Splunk Authentication to load dashboards

gcusello — Tue, 29 Sep 2020 17:48:10 GMT

Hi Arun_N_007,
sorry but I cannot reach your url!
Anyway, if I correctly understood, your need is to have a Single Sign On from your intranet site and your Splunk dashboards, is it correct ?

Did you already see https://docs.splunk.com/Documentation/Splunk/7.0.1/Security/HowSplunkSSOworks ?

Bye.
Giuseppe

Re: Bypassing Splunk Authentication to load dashboards

prashantkumar_g — Wed, 30 Sep 2020 03:06:01 GMT

steps to do this:
1.go to splunk/etc/system/local
2.open web.conf and add following settings:
enable_insecure_login = true

then restart splunk
go to browser and hit splunk by following address
http://localhost:8000/en-US/account/insecurelogin?return_to=%2Fen-US%2Fapp%2Fsearch%2FDASHBOARD_NAME?loginType=splunk&username=XXXXXXX&password=XXXXXXX

Re: Bypassing Splunk Authentication to load dashboards

pir8radio — Tue, 29 Jun 2021 04:29:40 GMT

the URL you couldn't reach was a url you posted. its broken. is what he was saying.

your message:

Hi Arun_N_007, this is possible if Splunk is configured for integration with Active Directory: it's possible to configure browser to execute automatic login using users account for authentication. In othe words: user does logon to AD domain when open his own computer ( “joined” to the domain). When user will connect to Splunk using own browser (configured as described in the following URL), he will not have to type his credentials again. https://prdsoftware.com/helpmasterlive/KnowledgeBase/kbarticle.aspx?view=107 Obviously this functionality runs only with a Splunk Enterprise License, it doesn't run with a free license