Getting Data In

Splunk SSO with mod_auth_kerb

dmesler
Explorer

I'm trying to enable SSO by proxying from Apache w/ mod_auth_kerb. The problems seems to be the contents of Remote-User include the @REALM. Is there some way to strip the realm from Remote-User in Apache or configure Splunk to ignore it?

Tags (2)
1 Solution

dmesler
Explorer

Upgrading mod_auth_kerb wasn't an option. Fortunately I had success adding this:

RequestHeader edit REMOTE_USER "@REALM$" ""

Thanks though.

View solution in original post

dmesler
Explorer

Upgrading mod_auth_kerb wasn't an option. Fortunately I had success adding this:

RequestHeader edit REMOTE_USER "@REALM$" ""

Thanks though.

ziegfried
Influencer

mod_auth_kerb >= 5.4 allows you to configure KrbLocalUserMapping On in your Apache configuration which will strip the realm part off the remote user sent to Splunk.

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...