Saved searches issue with SSO

[lrhazi]

With all saved searches, I get this error when I try to run them:

The saved search "%2FservicesNS%2Fnobody%2Fsearch%2Fsaved%2Fsearches%2FErrors%2520in%2520the%2520last%252024%2520hours" could not be found.

am using Splunk 5.0

Also, when I first create a search, the popup wizard give this error:

500 Internal Server Error

Return to Splunk home page

ResourceNotFound: [HTTP 404] https://127.0.0.1:8089/services/%2FservicesNS%2Fml623%2Fsearch%2Fsaved%2Fsearches%2Ftest03; []

The search is effectivily created, as I can see iet later on in the drop down and in Saved Searches....

am thinking these two issues are related...
I must be missing some setting that helps the GUI know it is now running behind a proxy.
But which setting is it?

[lrhazi · Accepted solution]

Support tells me this a bug related to SSL:

SPL-57518 has been assigned to this
issue. It happens because there is
wrong uri encoding from splunkweb when
using SSL.

[lrhazi]

To be clear, I did some configuration, and it is exactly the document you linked. I am sure I missed something though, but what is it?

[lrhazi]

No, I did not. That document says to only add anything if the proxy is hosting splunk on non root uri:

If you host Splunk Web behind a proxy that does not place Splunk Web at the proxy's root, you may also need to configure the root_endpoint setting in $SPLUNK_HOME/etc/system/local/web.conf.

What should I put in web.conf exactly, regarding the URIs?

[gkanapathy]

http://docs.splunk.com/Documentation/Splunk/5.0/Security/ConfigureSplunkSSO

[gkanapathy]

So, you did no configuration to tell Splunk that you are behind an SSO proxy.

[lrhazi]

Not sure what you mean by "what configuration you did perform". My proxy is what I believe to be a typical apache proxy config, performing ldap auth and forwarding traffic to localhost:8000 where splunk web is running by default.

[gkanapathy]

It may be easier to advise you if you indicated what configuration you did perform, and how exactly you and your proxy access Splunk.