Security

splunk behind an apache proxy login issue

mdubbyap
New Member

My splunk instance is is behind an apache proxy. Everything works correctly except for login. When i log into splunk, the return_to param is being url quoted twice, but only url unquoted once it seems.

e.g. I go to my host https://host/splunk and get redirected to the login screen with this url https://host/splunk/en-US/account/login?return_to=%252Fsplunk%252Fen-US%252F
(note the return_to being quoted twice). After i authenticate i get a 404 at http://app241.auto.mobileiron.com/%2Fsplunk%2Fen-US%2F (notice not https, and the quoted path).

Thoughts?

My splunk and apache configs looks like this:
in apache ssl.conf:

ProxyPass http://127.0.0.1:8000/splunk
ProxyPassReverse http://127.0.0.1:8000/splunk

in web.conf
root_endpoint = /splunk
tools.proxy.on = True

Tags (2)
0 Karma

mdubbyap
New Member

Ok, figured out a solution. This does appear to be a splunk weirdness, but one can get around it by adding AllowEncodedSlashes On to your vhost for :80. Will allow you to parse the doubly quoted path. I already have http redirecting to https and the rest just worked.

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...