topic Re: Splunk Web hanging loading screen after enabling SSO in Security

Splunk Web hanging loading screen after enabling SSO

jbrocks — Wed, 22 May 2019 06:26:14 GMT

Hi everybody,

my customer just configured SSO via Webseal. We are able to get to Splunk Web with the junction in the URL, but when we get to Splunk Web, we only see the dark menu bar with the Splunk logo and the rest of the page is grey with "Loading..." in the middle. Before configuring SSO everything works fine. Are there any suggestions, why we are now getting the hanging loading screen?

Re: Splunk Web hanging loading screen after enabling SSO

goodair — Wed, 22 May 2019 06:30:33 GMT

Have a look at $SPLUNK_HOME/var/log/splunk/splunkd.log on your search head, there should be something there indicating what configuration is causing the hold-up

Re: Splunk Web hanging loading screen after enabling SSO

jbrocks — Wed, 22 May 2019 07:05:19 GMT

Yes I just checked and found an error message starting with "ERROR UiAuth - user= action=login status=failure reason=sso-strict-but-wrong-ip" does this mean, I need to add a ip to web.conf trustedIP?

Re: Splunk Web hanging loading screen after enabling SSO

goodair — Wed, 22 May 2019 23:01:05 GMT

Looks like Splunk is seeing a different IP address than it expects, take a look at the rules in your IP tables to see if any masquerading is being done that might make traffic appear to come from a different address.

You can also add the address to trustedIP or set SSOMode to permissive (but have a read of the web.conf docs to understand the implications of the latter.)