Security

SSO mode permissive but 401 Unauthorized when accessing with an unknown user

gfyhser
Engager

Hello Everyone,

We are facing with an issue with our Splunk configuration : We have currently configured Splunk to accept connections in a permissive way (with SSOMode=permissive in the web.conf config file).
This actually works fine, and we are correctly redirected to the login page when accessing with a non trusted ip.
The problem is, when we are accessing with a trusted ip and a unknown user in splunk, it shows us an "Unauthorized" message, and rejects us with a 401.

Is there a way not to reject the connection, and instead show the login page is the user is unknown just as the non-trusted ip case ?

Thanks,

0 Karma
1 Solution

tmarlette
Motivator

Not really with SSO. You might be able to redirect to this page.

http://splunkweb:port/en-US/account/login/loginType=Splunk

View solution in original post

tmarlette
Motivator

Not really with SSO. You might be able to redirect to this page.

http://splunkweb:port/en-US/account/login/loginType=Splunk

gfyhser
Engager

Adding this to the web.conf solved the issue. Thanks

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...