logging in with local admin while SSO is enabled.

[anoopambli]

We have splunk instance enabled with SSO using CA siteminder. The user authorization is using splunk user config. All users configured with splunk are able to authenticate and authorize correctly. Keeping SSO enabled, is there anyway we can login to splunk using the local admin account of splunk?

We are accessing splunk via the proxy URL and direct URL of splunk would give SSO error.

this is the web.conf and server.conf configuration

web.conf
[settings]
\#SSO
SSOMode = strict
trustedIP = 10.93.171.10
remoteUser = Corpid
\#tools.proxy.on = true

server.conf
[general]
trustedIP=127.0.0.1

[linu1988]

You can with your default splunk web access port. which is by default 8000. Splunk authenticated user will be able to access through this. Others can use SSO like you have configured.

[alacercogitatus · Accepted solution]

You can login with the local admin user. You need to set SSOMode = permissive.

Permissive: Requests to Splunk Web that originate from an untrusted IP address
are redirected to a login page where they can log into Splunk without using SSO.

[anoopambli]

So that means once you have SSO enabled, you cant use the local account as that is not bound with any domain user account for authentication. The option left is to assign admin roles to one of the domain user who can authenticate. Is that correct?

[linu1988]

I guess it's not possible. You can assign one user, admin privilege. the local admin can access through splunk web default port. As LDAP will not find any name "admin" in your groups i suppose it's not possible.