Security

Splunk ProxySSO – Logout or session time-out redirection not working as expected

pbadhe_2
Engager

We have a Splunk cluster setup configured to use ProxySSO. Our LB is playing role of Proxy server and it passes all the required credentials, group Info, user identity etc. to the Splunk Web through HTTP headers. After getting this information Splunk properly authenticates and displays expected dashboards using appropriate authorization.

The issue comes when user either clicks the Logout option of Splunk OR session timeout happen due to in-activity. The expectation is - Splunk should redirect to the URL as configured in Proxy server but actually the redirection doesn’t work and after logging out the Splunk Login page is displayed. Proxy server URL is configured to property redirectAfterLogoutToUrl under [ssosettings] stanza. But its not working. We want to redirect the user to a separate page but ends up in displaying Splunk Login page.

How to configure this with ProxySSO authentication method?

Thanks

Tags (2)

pbadhe_2
Engager

Here are the configurations I am using:
web.conf
[root@searchead01 local]# cat web.conf
[settings]
updateCheckerBaseURL = 0
enableSplunkWebSSL = true
splunkdConnectionTimeout = 10800
sslVersions = *,-ssl2,-ssl3,-tls1.0,-tls1.1
cipherSuite = TLSv1.2:!eNULL:!aNULL
ecdhCurves = prime256v1,secp384r1,secp521r1
dhFile = /opt/splunk/etc/auth/splunkweb/dh2048.pem
allowSslCompression = false
enableWebDebug = true
x_frame_options_sameorigin = False
remoteUser = REMOTE_USER
remoteGroups = REMOTE_GROUPS
remoteUserMatchExact = 0
remoteGroupsMatchExact = 0
SSOMode = strict
trustedIP = 127.0.0.1,10.20.30.40

authentication.conf
[root@searchhead01 local]# cat authentication.conf
[authentication]
authType = ProxySSO
authSettings = ssosettings

[ssosettings]

idpSLOUrl = https://Path/To/Custom/logout.html

redirectAfterLogoutToUrl = https://Path/To/Custom/logout.html

[roleMap_proxySSO]
splunkrole1 = cn=activedirectorygroup1
splunkrole2 = cn=activedirectorygroup2
splunkrole3 = cn=activedirectorygroup3

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...