Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Re: insecurelogin fails
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
insecurelogin fails
I followed the instructions found in http://docs.splunk.com/Documentation/Splunk/latest/Developer/3rdParty to set up insecurelogin so that I can embed views in our web portal. I placed the following in web.conf:
[settings]
enable_insecure_login = true
My sample web page looks like this
<html>
<head>
<meta HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<title ID=titletext>Splunk Test</title>
</head>
<body>
<h1>Splunk View Test</h1>
<iframe src="http://192.168.50.135:8000/en-US/account/insecurelogin?username=admin&password=changeme&return_to=/app/FMS/FMS_Test_Stats">
Your browser does not support IFrames
</iframe>
</body>
</html>
I see the headline when I call the page but in Firefox I get this:
File not found
Firefox can't find the file at http://192.168.50.135:8000/en-US/account/insecurelogin?username=admin&password=changeme&return_to=/a....
Internet Explorer throws a message box with this:
Internet Explorer cannot download insecurelogin from 192.168.50.135
Internet Explorer was not able to open the Internet site. The requested site is either unavailable or cannot be found. Please try again later.
If I log directly into Splunk I can see the view. It is in advanced XML
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- I have splunk running on MAC and web.conf file is in/Applications/splunk/etc/system/default/web.conf (not $SPLUNK_HOME/etc/system/local/web.con). local directory does not have a web.conf file.
- In order to achieve the insecure login I ended up also updating "tools.sessions.secure = True" to False
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It suddenly hit me! I checked web.conf and found a second instance of insecurelogin set to false. As soon as I removed that it worked.
Sometimes things are too simple.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What happens if you copy & paste your iframe link directly into your browser? If you have to "log in" (which you kind of imply at the end of your post) then your insecure login setup is wrong. There should be no login required with that link.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the location of the web.conf file you modified? - I believe it has to be at the system level (i.e. $SPLUNK_HOME/etc/system/local/web.conf)
Did you restart Splunk? - I think you can just restart splunkweb, if you do not want a full restart (i.e. ./splunk restart splunkweb)
You should also include a size in the iframe (e.g. in the example... width="100%" height="300")
Regards,
MHibbin
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Been there done that. I've tried everything.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
also are you still using the default admin password (i.e. "changeme").. I assume you are as that is what you have included in the url
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How about changing the "/" to "%2F" as in the docs
Forexample:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is in etc/system/local
And I did stop and restart Splunk.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...
July Community Events: Master ITSI 5.0 & Automate Splunk
New Release of Federated Search: Bringing Splunk Analytics to More of Your Data
