topic Re: Using RSA Authentication to Login to Splunk in Dashboards & Visualizations

Using RSA Authentication to Login to Splunk

aferone — Wed, 06 Jul 2011 19:24:42 GMT

Hello all,

I have been tasked with using RSA tokens to login to our Splunk environment. I have been asking around, including the vendor, and still don't have good documentation on how to set this up. We have Splunk installed on Ubuntu. I am told it does work, but I have yet to get my hands on any documentation.

Thanks!

Alex

Re: Using RSA Authentication to Login to Splunk

gkanapathy — Thu, 07 Jul 2011 03:56:14 GMT

The general approach is to configure the RSA authentication agent on Apache, configure Splunk to use the same user directory, proxy Splunk behind the Apache server, configure the RSA agent login page to set a cookie containing the user name, and configure Apache to copy the cookie value to an HTTP header that Splunk is configured to read the username from.

Re: Using RSA Authentication to Login to Splunk

bnolen — Thu, 07 Jul 2011 07:17:31 GMT

Another approach (though a little more fiddly) is to configure scripted authentication, with the script calling RADIUS.

Re: Using RSA Authentication to Login to Splunk

aferone — Thu, 07 Jul 2011 15:39:47 GMT

Thanks for the answer. Did it take a long time for you to implement?

Re: Using RSA Authentication to Login to Splunk

msettipane — Thu, 07 Jul 2011 17:40:15 GMT

RSA SecurID and Splunk SSO Integration

Problem: RSA SecurID passes the username to Apache with a unique session id attached to the username.

Simple Solution: Pass Apache the username as input by the user in the RSA SecurID login page.

First read Use single sign-on (SSO) with Splunk
Configure Apache as Proxy Server

Add RSA Webagent to Apache httpd.conf

 include /opt/apache/rsawebagent/rsawebagent.conf

Go to the The RSA Authentication Agent and configure the Web Agent to use the same login screen for username and passcode.
Modify the RSA Webagent useridandpasscode.htm

Add JavaScript to the Page

function SetCookie(cookieName,cookieValue) { var today = new Date(); var expire = new Date(); expire.setTime(today.getTime() + 3600000*24); document.cookie = cookieName+"="+escape(cookieValue) + ";expires="+expire.toGMTString(); }

Edit Form Submission

//myForm.userid.value = myForm2.userid.value; SetCookie("SPLUNKUSER",myForm.username.value);

Modify Apache httpd.conf to Capture the Cookie

<virtualHost …..>
 SetEnvIf Cookie "SPLUNKUSER=([^;]\w+)" rsauser=$1 
 RequestHeader set USERNAMEHEADER %{rsauser}e 
</VirtualHost>

Modify Splunk web.conf in the local directory to accept the new Apache header username
```
 remoteUser = USERNAMEHEADER
```
Check the debug page to ensure SPLUNKUSER is being passed to Splunk
```
 http://YourSplunkServer:8000/debug/sso
```

Re: Using RSA Authentication to Login to Splunk

aferone — Thu, 07 Jul 2011 18:14:41 GMT

Thank you very much!

Do you know offhand if there is an RSA WebAgent for Ubuntu? I can't seem to find one.