Splunk doesn't link SSO/HTTP Header ID to Splunk ID

[tavandek]

I have Splunk v4.2.2 configured for SSO using an external CAS gateway with an Apache reverse proxy.

I've had to set a remoteUser other than 'REMOTE_USER' to get this far, but it appears to be working/accepted to the point where Splunk isn't correlating the HTTP header remoteUser to the local splunk account.
I'm getting an error:
auth:56 - getSessionKey - unable to login; check credentials
decorators:192 - Could not authenticate user XXXXXXX via SSO. Does XXXXXXX have a matching splunk account with the same username?

I'm able to log into the Splunk port with the same local account, but logging in via the proxy/CAS server doesn't find the same local account for the userid that's being delivered in the Remote User HTTP Header.

The information in the debug/sso page all looks correct/accepted. Incoming request IP is trusted and the HTTP header/value for the remote user is correct.

I have no idea how to further debug this.
Is there a known fix for this, or a way to add any more details to the debug info via mrsparkle code?

[lukejadamec]

Thank you very much.

[tavandek]

Found/fixed it.

trustedIP in the server.conf file was set to the server's ip address instead of 127.0.0.1, which is apparently what splunkd requires to do SSO validation.

This was separate/different from the trustedIP in the web.conf, which was being accepted.

splunkd.log displayed these errors, whereas web_service.log had displayed the previous trustedIP matching errors.

[kaddupa1]

Awesome, thanks. That was the Problem i had as well 🙂

[Dark_Ichigo]

Thank you so much, this solved a great issue I was having, you wont believe how much trouble I went through....THANK YOU!!!!!!!