Security

Splunk ProxySSO – Logout or session time-out redirection not working as expected

pbadhe_2
Engager

We have a Splunk cluster setup configured to use ProxySSO. Our LB is playing role of Proxy server and it passes all the required credentials, group Info, user identity etc. to the Splunk Web through HTTP headers. After getting this information Splunk properly authenticates and displays expected dashboards using appropriate authorization.

The issue comes when user either clicks the Logout option of Splunk OR session timeout happen due to in-activity. The expectation is - Splunk should redirect to the URL as configured in Proxy server but actually the redirection doesn’t work and after logging out the Splunk Login page is displayed. Proxy server URL is configured to property redirectAfterLogoutToUrl under [ssosettings] stanza. But its not working. We want to redirect the user to a separate page but ends up in displaying Splunk Login page.

How to configure this with ProxySSO authentication method?

Thanks

Tags (2)

pbadhe_2
Engager

Here are the configurations I am using:
web.conf
[root@searchead01 local]# cat web.conf
[settings]
updateCheckerBaseURL = 0
enableSplunkWebSSL = true
splunkdConnectionTimeout = 10800
sslVersions = *,-ssl2,-ssl3,-tls1.0,-tls1.1
cipherSuite = TLSv1.2:!eNULL:!aNULL
ecdhCurves = prime256v1,secp384r1,secp521r1
dhFile = /opt/splunk/etc/auth/splunkweb/dh2048.pem
allowSslCompression = false
enableWebDebug = true
x_frame_options_sameorigin = False
remoteUser = REMOTE_USER
remoteGroups = REMOTE_GROUPS
remoteUserMatchExact = 0
remoteGroupsMatchExact = 0
SSOMode = strict
trustedIP = 127.0.0.1,10.20.30.40

authentication.conf
[root@searchhead01 local]# cat authentication.conf
[authentication]
authType = ProxySSO
authSettings = ssosettings

[ssosettings]

idpSLOUrl = https://Path/To/Custom/logout.html

redirectAfterLogoutToUrl = https://Path/To/Custom/logout.html

[roleMap_proxySSO]
splunkrole1 = cn=activedirectorygroup1
splunkrole2 = cn=activedirectorygroup2
splunkrole3 = cn=activedirectorygroup3

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...