Is it possibly to log a user in to Splunk automatically without setting enable_insecure_login to true and sending the user/password as query params?

[active]

It used to be possible to log a user in to Splunk by sending the username and password in the body of a POST request which now no longer works. It is possible to set enable_insecure_login to true and send the user/password to the /account/insecurelogin endpoint as query parameters but this means the information could be logged somewhere or saved in the user's browser history. Is there another way to allow a user to click a link in another application and be redirected to the Splunk search page without having to log in themselves?

[BunnyHop]

You can use the SSOMode.

http://www.splunk.com/base/Documentation/4.1.2/Admin/Usesinglesign-onwithSplunk

[Johnvey]

Currently, the insecure login feature is only for GET-based requests. The reason that you cannot send a POST directly to the default login page is because of the cookie checker routine.

If you are on version 4.1, the recommended way to do transparent login is to enable the single sign-on feature in conjunction with your authentication system.

If you are not on that version or do not have a centralized authentication system, then you'll have to write some kind of script that mimics the cookie checker by:

1. setting a client cookie called cval with a static value
2. passing the static value above as a POST arg also called cval
3. passing the username and password args

This would then simulate a POST-based user action to the main login endpoint. To set the final destination page after a successful login, add a parameter return_to to the POST payload that is the relative URI of the destination.