Splunk Search

Splunk access to External users

Manasa_401
Communicator

Hello Splunkers,

My Splunk instance is configured with default SAML authentication. Now i wanted to add users from external domain to access list of Splunk dashboards. How can i do that?

I searched in community and found that we can use en-US/account/login?loginType=splunk after changing enable_insecure_login = False in web.conf

I'm little worried about the consequences after I change the above setting. 
Is there any way to provide access to external users without any concerns with security.

Thank you in advance!

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You do not have to do anything to enable_insecure_login to allow external users to use your Splunk.  Just add a Splunk account for them and give them the loginType URL.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Manasa_401
Communicator

Hello @richgalloway 

I created Splunk account to the user and gave URL en-US/account/login?loginType=splunk
but getting Bad Request

Manasa_401_0-1712242845075.png

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"en-US/account/login?loginType=splunk" is the tail end of the URL.  Append it to your standard Splunk URL (https://<<my splunk>>/en-US/account/login?loginType=splunk).

---
If this reply helps you, Karma would be appreciated.
0 Karma

Manasa_401
Communicator

Hello @richgalloway 

Yes, I appended that to my instance URL and got that bad request.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try loginType=Splunk

---
If this reply helps you, Karma would be appreciated.
0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @Manasa_401 

response  provided by @richgalloway , will work. 

 https://localhost:8000/en-US/account/login?loginType=splunk

In addition to rich reponse. if your existing URL contains 8000 number keep that as well.
sometimes it might be issue with  language en-us or en-gb , kindly try with  language for URL with SAML auth



0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...