Using SSO with Forefront Threat Management Server (ISA)?

[Steve_Litras]

I'm trying to get Splunk SSO working with MS - Forefront TMG (we're thinking about deploying it as our proxy solution), and I can't find a way to make it provide the REMOTE_USER header that splunk SSO requires. I've looked at the HeliconTech plug-in that Splunk recommends for IIS, but it doesn't appear to support ISA/TMG.

Anybody done this? If so, what's the secret sauce to make it work?

Thanks, Steve

[gkanapathy]

You don't need any plugin for ISA. It should be able to send the user id of the authenticated user to downstream web servers (i.e., SplunkWeb), but it's possible that it isn't sending it in the Remote-User/REMOTE_USER HTTP header/variable. You can check the debug page in SplunkWeb to see if it is being sent in a different variable. There may also be some option in the ISA configuration to enable it to send the header. But actually I am surprised that it does not do this by default in reverse proxy mode. (I would expect in forward proxying that it would not forward the user id.)

[Steve_Litras]

It doesn't appear to send any header with just the authenticated user (I've been taking tcpdump's off the target splunk server to verify that). The user name is in the cookie, but the cookie would have to be split up.