I have Splunk v4.2.2 configured for SSO using an external CAS gateway with an Apache reverse proxy.
I've had to set a remoteUser other than 'REMOTE_USER' to get this far, but it appears to be working/accepted to the point where Splunk isn't correlating the HTTP header remoteUser to the local splunk account.
I'm getting an error:
auth:56 - getSessionKey - unable to login; check credentials
decorators:192 - Could not authenticate user XXXXXXX via SSO. Does XXXXXXX have a matching splunk account with the same username?
I'm able to log into the Splunk port with the same local account, but logging in via the proxy/CAS server doesn't find the same local account for the userid that's being delivered in the Remote User HTTP Header.
The information in the debug/sso page all looks correct/accepted. Incoming request IP is trusted and the HTTP header/value for the remote user is correct.
I have no idea how to further debug this.
Is there a known fix for this, or a way to add any more details to the debug info via mrsparkle code?
Thank you very much.
Found/fixed it.
trustedIP in the server.conf file was set to the server's ip address instead of 127.0.0.1, which is apparently what splunkd requires to do SSO validation.
This was separate/different from the trustedIP in the web.conf, which was being accepted.
splunkd.log displayed these errors, whereas web_service.log had displayed the previous trustedIP matching errors.
Awesome, thanks. That was the Problem i had as well 🙂
Thank you so much, this solved a great issue I was having, you wont believe how much trouble I went through....THANK YOU!!!!!!!