topic How to setup DOD CAC Login for Splunk Web in Splunk Search

How to setup DOD CAC Login for Splunk Web

scc00 — Tue, 01 May 2018 20:11:48 GMT

I have been asked to ensure that the DOD CAC can be used to log into the Splunk Search Heads. Does anyone know how to do this? Is there any documentation somewhere i can reference.

Thanks much.

Re: How to setup DOD CAC Login for Splunk Web

elliotproebstel — Tue, 01 May 2018 20:33:09 GMT

In our environment, users log in to their workstations with a card that is similar to DOD CAC. Their authentication is done with an ADFS server. When they access Splunk, we are using SAML authentication to verify their identity. Is this what you're looking for? If so, there are a few options:

Your users are all in the same "user" role bucket and don't need a lot of specialized roles - in this case, you can use Splunk SAML authentication to pass UPN values.
Your users have different roles, and those roles can be maintained in your ADFS records - in this case, you can still use Splunk SAML authentication, and ADFS will pass UPN and role info.
Your users have different roles, and those roles need to be managed within Splunk, because you can't be bothering the ADFS team to manage those roles - in this case, you can wrap Splunk with Apache, acting as a reverse proxy, and shibboleth, which manages the SAML.

Re: How to setup DOD CAC Login for Splunk Web

scc00 — Thu, 03 May 2018 18:29:14 GMT

Thanks so much for the response. No i was more looking into how to get them to log into Splunk using the CAC without involving any third party tools. Is that possible?

Re: How to setup DOD CAC Login for Splunk Web

elliotproebstel — Mon, 07 May 2018 18:29:40 GMT

Do you mean you want them to use a CAC to log in without having some kind of SSO identity provider, such as ADFS? I don't know of any such way to do that. But if Splunk is running in a traditional enterprise environment where users a logging into their workstations with a CAC, then integration with ADFS is pretty straightforward.

Re: How to setup DOD CAC Login for Splunk Web

scc00 — Mon, 18 Jun 2018 13:10:28 GMT

As it turns out splunk does not have any direct method. So they provided documentation to utilize a proxy with the CAC.

Re: How to setup DOD CAC Login for Splunk Web

don1966 — Tue, 18 Jan 2022 15:32:28 GMT

Good morning,

May I have a copy of that documentation? I am trying to get the same thing done with our Splunk server.

Thank you