Security

splunk behind an apache proxy login issue

mdubbyap
New Member

My splunk instance is is behind an apache proxy. Everything works correctly except for login. When i log into splunk, the return_to param is being url quoted twice, but only url unquoted once it seems.

e.g. I go to my host https://host/splunk and get redirected to the login screen with this url https://host/splunk/en-US/account/login?return_to=%252Fsplunk%252Fen-US%252F
(note the return_to being quoted twice). After i authenticate i get a 404 at http://app241.auto.mobileiron.com/%2Fsplunk%2Fen-US%2F (notice not https, and the quoted path).

Thoughts?

My splunk and apache configs looks like this:
in apache ssl.conf:

ProxyPass http://127.0.0.1:8000/splunk
ProxyPassReverse http://127.0.0.1:8000/splunk

in web.conf
root_endpoint = /splunk
tools.proxy.on = True

Tags (2)
0 Karma

mdubbyap
New Member

Ok, figured out a solution. This does appear to be a splunk weirdness, but one can get around it by adding AllowEncodedSlashes On to your vhost for :80. Will allow you to parse the doubly quoted path. I already have http redirecting to https and the rest just worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...