Security

Are there plans that SSO can handle roles?

chris
Motivator

Will Splunk be able to accept roles with the SSO setup in the future?

So an authentication Proxy could set a REMOTE_ROLES header variable besides the REMOTE_USER

The way I understand SSO this is not possible at the moment.

Tags (1)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

At the moment, there are no such plans. SSO is designed only to provide authentication (proving that the user is who they claim to be) and not authorization (determining whether a user can perform some given action).

You can use scripted authentication to deliver authorization based on whatever system that you choose to map users to roles.

View solution in original post

0 Karma

RubenOlsen
Path Finder

As long as the Splunk software provide the ability for REMOTE_USER from a trusted source (i.e. proxy) within a company, it does not make any sense that Splunk Inc dictate that role information provided from the same trusted source not be used. It should be up to the company where Splunk is deployed to dictate how authentication is performed.

In our organization we use a well known reverse proxy product from IBM. If a user is correctly authenticated - the proxy will provide two HTTP headers for the back end services server (whatever these may be): One is HTTP header provides which contains the authenticated users, user name; the other is which contains a comma separated list of roles.

Splunk should, if the customer configures it that way, use the HTTP header where the roles are present.

Using scripted authentications creates CPU over head and complicate things, and using the same back end security storage that the web proxy is using might even not be possible for policy reasons.

Stephen_Sorkin
Splunk Employee
Splunk Employee

At the moment, there are no such plans. SSO is designed only to provide authentication (proving that the user is who they claim to be) and not authorization (determining whether a user can perform some given action).

You can use scripted authentication to deliver authorization based on whatever system that you choose to map users to roles.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...