Security

Bypassing Splunk Authentication to load dashboards

Arun_N_007
Communicator

Hi,

I would like to embed Splunk as an iframe in my we application. Here we need to load Splunk dashboard on load of the page bypassing its authentication.

Here Authentication will be done for that user in third party system while logging in to my web app.

Here am not talking about the insecure login which passes password in the header. Can i use HTTP POST for insecure login? If yes then how?

Regards,
Arun

0 Karma

prashantkumar_g
Engager

steps to do this:
1.go to splunk/etc/system/local
2.open web.conf and add following settings:
enable_insecure_login = true

then restart splunk
go to browser and hit splunk by following address
http://localhost:8000/en-US/account/insecurelogin?return_to=%2Fen-US%2Fapp%2Fsearch%2FDASHBOARD_NAME...

sjohnson_splunk
Splunk Employee
Splunk Employee

Scripted authentication is supported. You should look at the authentication.conf.spec file.

There are also samples of scripts located at: $SPLUNK_HOME/share/splunk/authScriptSamples

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Arun_N_007,
this is possible if Splunk is configured for integration with Active Directory: it's possible to configure browser to execute automatic login using users account for authentication.
In othe words: user does logon to AD domain when open his own computer ( “joined” to the domain).
When user will connect to Splunk using own browser (configured as described in the following URL), he will not have to type his credentials again.
https://prdsoftware.com/helpmasterlive/KnowledgeBase/kbarticle.aspx?view=107

Obviously this functionality runs only with a Splunk Enterprise License, it doesn't run with a free license.

Bye.
Giuseppe

0 Karma

surekhasplunk
Communicator

Hi @cusello,

Could you please activate the link https://prdsoftware.com/helpmasterlive/KnowledgeBase/kbarticle.aspx?view=107 as i cant find any details in that page.
My scenario is my users are AD enabled and i want to bypass the login screen of splunk and show them the default dashboard as per their roles.
Pls help.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Arun_N_007,
sorry but I cannot reach your url!
Anyway, if I correctly understood, your need is to have a Single Sign On from your intranet site and your Splunk dashboards, is it correct ?

Did you already see https://docs.splunk.com/Documentation/Splunk/7.0.1/Security/HowSplunkSSOworks ?

Bye.
Giuseppe

0 Karma

pir8radio
Path Finder

the URL you couldn't reach was a url you posted.   its broken. is what he was saying.

your message:

Hi Arun_N_007,
this is possible if Splunk is configured for integration with Active Directory: it's possible to configure browser to execute automatic login using users account for authentication.
In othe words: user does logon to AD domain when open his own computer ( “joined” to the domain).
When user will connect to Splunk using own browser (configured as described in the following URL), he will not have to type his credentials again.
https://prdsoftware.com/helpmasterlive/KnowledgeBase/kbarticle.aspx?view=107

Obviously this functionality runs only with a Splunk Enterprise License, it doesn't run with a free license
0 Karma

Arun_N_007
Communicator

Here am not using AD... I need authentication done by system specific to our product and Splunk should let me in.

Can we use external scripts to achieve this? And here we want to pass only username and Web session id here... Which can be validated in script to let me in Splunk.

0 Karma

gcusello
SplunkTrust
SplunkTrust

We have always AD, I don't know other ways.
Sorry.
bye.
Giuseppe

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

One of the way's is using the embed report functionality of Splunk. This does not need any authorization and can open in any html.

https://docs.splunk.com/Documentation/Splunk/6.5.1/Report/Embedscheduledreports

Happy Splunking!
0 Karma

Arun_N_007
Communicator

No embed report got some limitations like...

  • No real time search
  • Report should be pre populated and should be loaded with saved searches.

I need to show my
Splunk dashboard UI in an iframe.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...