Hybrid Login with SSO and Traditional Login in Splunk (SSO + Local Auth)

[uagraw01]

Hi Splunkers!!,

We have recently configured SSO in Splunk using Keycloak, and it's working fine — users are able to log in through the Keycloak identity provider.

Now, we have a new requirement where some users should be able to bypass SSO and use the traditional Splunk login (username/password) instead.

Current Setup:

• Splunk SSO is configured via Keycloak (SAML).

• All users are redirected to Keycloak for authentication.

• We now want to allow dual login options:

  • Primary: SSO via Keycloak (default for most users).

  • Secondary: Traditional login for selected users (e.g., admins, service accounts).

Objective:

Allow both SSO and non-SSO (Splunk local authentication) login methods to coexist.


Below is our setting for SSO.

[authentication]
authSettings = saml
authType = SAML

[roleMap_SAML]
commissioning_engineer = integration
hlc_support_engineer = integration

[saml]
caCertFile = D:\Splunk\etc\auth\cacert.pem
clientCert = D:\Splunk\etc\auth\server.pem
entityId = splunk
fqdn = https://splunk.kigen-iht-001.cnaw.k8s.kigen.com
idpCertExpirationCheckInterval = 86400s
idpCertExpirationWarningDays = 90
idpCertPath = idpCert.pem
idpSLOUrl = https://keycloak.walamb-iht-001.cnap.k8s.kigen.com/auth/realms/production/protocol/saml
idpSSOUrl = https://keycloak.walamb-iht-001.cnap.k8s.kigen.com/auth/realms/production/protocol/saml
inboundDigestMethod = SHA1;SHA256;SHA384;SHA512
inboundSignatureAlgorithm = RSA-SHA1;RSA-SHA256;RSA-SHA384;RSA-SHA512
issuerId = https://keycloak.walamb-iht-001.cnap.k8s.kigen.com/auth/realms/production
lockRoleToFullDN = true
redirectPort = 443
replicateCertificates = true
scimEnabled = false
signAuthnRequest = true
signatureAlgorithm = RSA-SHA1
signedAssertion = true
sloBinding = HTTP-POST
sslPassword = $7$CCkQUt0tA8sZJMmU+8kigen0zdv/mxXjJsLRbmuBkEnMfhQ==
ssoBinding = HTTP-POST

[userToRoleMap_SAML]
kg-user = commiss_engineer;hlc_support_engineer::::

[isoutamo]

One additional comment. As told in previous post splunk support that loginType=splunk works and there is always at least admin account which cannot be anything else than local.

BUT if there are any WAF before your Splunk service login then there could be some WAF rules which denies to add this additional loginType parameter into URL. If this happens then you need to discuss with those security staff that they will allow that additional parameter e.g. in some specific addresses.

[livehybrid · Accepted solution]

Hi @uagraw01 

In order to bypass the SAML auth, you need to navigate to the following URL, replacing the fqdn/port with your deployment info:

https://fqdn:splunkport/en-US/account/login?loginType=splunk
This will provide the standard Splunk login form. For more info also check out the following knowledge base article: https://splunk.my.site.com/customer/s/article/How-to-login-into-Splunk-using-local-Splunk-accounts-a... and further info on the SAML docs page at https://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSSOinSplunkWeb#:~:text=To%20ac...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing