Disable local user login bypass

[riyastk]

Hi,

I have enabled SSO authentication for my splunk instance. However, I am still able to login as local user with en-US/account/login?loginType=splunk option. Is there an option to disable this bypassing to tighten security?

[nickhills]

You can not disable local authentication, but you can prevent it from working.
Bear in mind that you can luse dap from the cli, but not SAML.

1. To "break" local authentication remove $SPLUNK_HOME/etc/passwd This will remove any local user passwords.
2. Restart Splunk, when prompted set a username and password for admin
3. Edit $SPLUNK_HOME/etc/passwd and replace random characters in the hash password field (making the old password unusable)
4. Restart Splunk - your admin password will no longer work.

Note any OS user with appropriate perms can perform steps 1-2 to regain access

[riyastk]

Is there anyway we can turn the login page blank or something ?

[nickhills]

no. I dont belive so.