Security

Bypassing Splunk Authentication to load dashboards

Communicator

Hi,

I would like to embed Splunk as an iframe in my we application. Here we need to load Splunk dashboard on load of the page bypassing its authentication.

Here Authentication will be done for that user in third party system while logging in to my web app.

Here am not talking about the insecure login which passes password in the header. Can i use HTTP POST for insecure login? If yes then how?

Regards,
Arun

0 Karma

steps to do this:
1.go to splunk/etc/system/local
2.open web.conf and add following settings:
enableinsecurelogin = true

then restart splunk
go to browser and hit splunk by following address
http://localhost:8000/en-US/account/insecurelogin?return_to=%2Fen-US%2Fapp%2Fsearch%2FDASHBOARD_NAME...

Splunk Employee
Splunk Employee

Scripted authentication is supported. You should look at the authentication.conf.spec file.

There are also samples of scripts located at: $SPLUNK_HOME/share/splunk/authScriptSamples

0 Karma

Legend

Hi ArunN007,
this is possible if Splunk is configured for integration with Active Directory: it's possible to configure browser to execute automatic login using users account for authentication.
In othe words: user does logon to AD domain when open his own computer ( “joined” to the domain).
When user will connect to Splunk using own browser (configured as described in the following URL), he will not have to type his credentials again.
https://prdsoftware.com/helpmasterlive/KnowledgeBase/kbarticle.aspx?view=107

Obviously this functionality runs only with a Splunk Enterprise License, it doesn't run with a free license.

Bye.
Giuseppe

0 Karma

Communicator

Hi @cusello,

Could you please activate the link https://prdsoftware.com/helpmasterlive/KnowledgeBase/kbarticle.aspx?view=107 as i cant find any details in that page.
My scenario is my users are AD enabled and i want to bypass the login screen of splunk and show them the default dashboard as per their roles.
Pls help.

0 Karma

Legend

Hi ArunN007,
sorry but I cannot reach your url!
Anyway, if I correctly understood, your need is to have a Single Sign On from your intranet site and your Splunk dashboards, is it correct ?

Did you already see https://docs.splunk.com/Documentation/Splunk/7.0.1/Security/HowSplunkSSOworks ?

Bye.
Giuseppe

0 Karma

Communicator

Here am not using AD... I need authentication done by system specific to our product and Splunk should let me in.

Can we use external scripts to achieve this? And here we want to pass only username and Web session id here... Which can be validated in script to let me in Splunk.

0 Karma

Legend

We have always AD, I don't know other ways.
Sorry.
bye.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

One of the way's is using the embed report functionality of Splunk. This does not need any authorization and can open in any html.

https://docs.splunk.com/Documentation/Splunk/6.5.1/Report/Embedscheduledreports

0 Karma

Communicator

No embed report got some limitations like...

  • No real time search
  • Report should be pre populated and should be loaded with saved searches.

I need to show my
Splunk dashboard UI in an iframe.

0 Karma