topic Re: Splunk local account login to splunkweb when SAML authentication is enabled? in Security

Splunk local account login to splunkweb when SAML authentication is enabled?

jeff — Fri, 06 May 2016 15:10:04 GMT

When configured for LDAP authentication, Splunk will "fall back" to splunk local accounts if the LDAP user isn't found. Is it possible to bypass SAML authentication to log in with a Splunk local account? I've tried a variety of things including statically pasting the link to

/en-US/account/login?

but no matter what, I'm directed to the ADFS AdP. Right now that's not working, so I need to make modifications and re-export the SAML metadata

/saml/spmedata

but even that forces me to the IdP login page. I'm kinda stuck... I did manage to switch authentication.conf to Splunk local logins so I could log in as local admin, make the appropriate changes, and re-export the metadata, but there must (should) be a way to allow this...

Re: Splunk local account login to splunkweb when SAML authentication is enabled?

jkat54 — Sat, 07 May 2016 00:19:29 GMT

Once you enable saml all splunk web endpoints are protected by the IdP. You might find something useful via the api on port 8089 however.

http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTaccess

Re: Splunk local account login to splunkweb when SAML authentication is enabled?

suarezry — Wed, 25 May 2016 19:11:37 GMT

/en-US/account/login?loginType=splunk

Re: Splunk local account login to splunkweb when SAML authentication is enabled?

jeff — Tue, 02 Aug 2016 18:55:28 GMT

Confirmed... actually found this out today outside of this thread and came back to update before I saw this answer. Thanks for the feedback!

Re: Splunk local account login to splunkweb when SAML authentication is enabled?

sgao — Wed, 07 Jun 2017 04:41:06 GMT

Need to add loginType=splunk& in a SAML env. For example
https://:8000/en-US/account/insecurelogin?loginType=splunk&username=&password=

Re: Splunk local account login to splunkweb when SAML authentication is enabled?

Sparky1 — Wed, 15 May 2019 18:41:27 GMT

Is there anyway to block this URI from being accessible. If for example the server is behind a loadbalancer? I've tried blocking the URI, but then it breaks SAML

Re: Splunk local account login to splunkweb when SAML authentication is enabled?

woodcock — Thu, 07 Nov 2019 14:11:39 GMT

Yes, it is in the docs:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf

enable_insecure_login = <boolean>
* Whether or not the GET-based "/account/insecurelogin" REST endpoint is enabled.
* Provides an alternate GET-based authentication mechanism.
* If "true", the following url is available:
http://localhost:8000/en-US/account/insecurelogin?loginType=splunk&username=noc&password=XXXXXXX
* If "false", only the main /account/login endpoint is available
* Default: false