track users logging in via SSO

[kaddupa1]

Hello,

we are using SSO with LDAP based users for authentication on our search heads. On our search head; how do we search or track for users logging in via SSO?

cheers

[MuS · Accepted solution]

Hi kaddupa1,

since you are using LDAP based users and SSO for authentication, user logins are not handled by Splunk and therefore you will not find any of the SSO / LDAP user logins in the audit.log.

But you can use the REST end point /services/authentication/httpauth-tokens on your search head like this

| rest /services/authentication/httpauth-tokens splunk_server=local  

and you will get a list of users which were or still are connect over SSO / LDAP.

Setting this up as saved search with summary indexing will give you the abillity to gether historical events as well.

hope this helps...

cheers,
MuS

[kaddupa1]

Thanks, that was exactly i was looking for.