Splunk Web hanging loading screen after enabling SSO

[jbrocks]

Hi everybody,

my customer just configured SSO via Webseal. We are able to get to Splunk Web with the junction in the URL, but when we get to Splunk Web, we only see the dark menu bar with the Splunk logo and the rest of the page is grey with "Loading..." in the middle. Before configuring SSO everything works fine. Are there any suggestions, why we are now getting the hanging loading screen?

[goodair]

Have a look at $SPLUNK_HOME/var/log/splunk/splunkd.log on your search head, there should be something there indicating what configuration is causing the hold-up

[jbrocks]

Yes I just checked and found an error message starting with "ERROR UiAuth - user= action=login status=failure reason=sso-strict-but-wrong-ip" does this mean, I need to add a ip to web.conf trustedIP?

[goodair]

Looks like Splunk is seeing a different IP address than it expects, take a look at the rules in your IP tables to see if any masquerading is being done that might make traffic appear to come from a different address.

You can also add the address to trustedIP or set SSOMode to permissive (but have a read of the web.conf docs to understand the implications of the latter.)