Security

How do I authenticate in Splunk using a reverse proxy?

lukaslentner
Explorer

I would like to use a reverse proxy in front of a Splunk instance which handles authentication using a custom logic.

For example, users should log in at the proxy with username ProxyUser1 and be authenticated in Splunk as SplunkUser1. I tried to use node-js for this task and it is not hard to set up a proxy to access Splunk, but I could not make the proxy do the logging in into Splunk. It looks like Splunk's REST API supports basic authentication, but direct access of the Splunk web interface is not possible using basic authentication. I also found SDKs like splunkjs which handle the authentication process, but (again) they only allow API access. What is the authentication method which is used in Splunk's web interface.

0 Karma

mattymo
Splunk Employee
Splunk Employee

Hey lukaslentner!

I would suggest checking out our docs on "Securing Splunk Enterprise", https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/WhatyoucansecurewithSplunk

specifically:

SSO:
https://docs.splunk.com/Documentation/Splunk/latest/Security/HowSplunkSSOworks

Splunk Single Sign-on (SSO) lets you use a reverse proxy to handle Splunk authentication, meaning that once the user has logged into their proxy, they can seamlessly access Splunk Web (and presumably any other applications configured to your proxy).

The reverse proxy implementation of Splunk Enterprise SSO supports logging into Splunk Enterprise only through Splunk Web. Since the implementation relies on cookies to save authentication information, SSO cannot be used for CLI authentication to Splunk Enterprise. Invoking https://localhost:8089 (or the assigned management port) still requires independent authentication.

It has a detailed break down on how it works. Hopefully this will steer you to success. Let us know how it goes!!

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...