Are there plans that SSO can handle roles?

[chris]

Will Splunk be able to accept roles with the SSO setup in the future?

So an authentication Proxy could set a REMOTE_ROLES header variable besides the REMOTE_USER

The way I understand SSO this is not possible at the moment.

[RubenOlsen]

As long as the Splunk software provide the ability for REMOTE_USER from a trusted source (i.e. proxy) within a company, it does not make any sense that Splunk Inc dictate that role information provided from the same trusted source not be used. It should be up to the company where Splunk is deployed to dictate how authentication is performed.

In our organization we use a well known reverse proxy product from IBM. If a user is correctly authenticated - the proxy will provide two HTTP headers for the back end services server (whatever these may be): One is HTTP header provides which contains the authenticated users, user name; the other is which contains a comma separated list of roles.

Splunk should, if the customer configures it that way, use the HTTP header where the roles are present.

Using scripted authentications creates CPU over head and complicate things, and using the same back end security storage that the web proxy is using might even not be possible for policy reasons.

[Stephen_Sorkin · Accepted solution]

At the moment, there are no such plans. SSO is designed only to provide authentication (proving that the user is who they claim to be) and not authorization (determining whether a user can perform some given action).

You can use scripted authentication to deliver authorization based on whatever system that you choose to map users to roles.