Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About suarezry
suarezry
Builder
Member since:
04-23-2014
06-05-2020
Community Statistics
| Posts | 170 |
| Solutions | 19 |
| Karma Given | 84 |
| Karma Received | 80 |
| Member Since | 04-23-2014 |
Activity Feed
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 10-03-2024 06:02 PM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 08-25-2023 02:00 AM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 07-28-2023 02:17 AM
- Got Karma for Re: Login with local account with SSO Okta enabled. 06-20-2023 04:26 AM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 09-01-2022 08:58 AM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 07-26-2022 06:22 AM
- Got Karma for Re: How can I control the client's Host Name that appears in Forwarder Management?. 10-26-2021 09:36 AM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 10-18-2021 06:44 AM
- Got Karma for Native SAML authentication with Shibboleth IdP. 01-19-2021 03:41 PM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 11-15-2020 03:33 AM
- Karma Re: How to concatenate a variable number of fields? for Sukisen1981. 06-05-2020 12:50 AM
- Karma Re: Kvstore has stuck at starting stage for all the search heads in cluster. for dkolekar_splunk. 06-05-2020 12:50 AM
- Karma ODBC connector for Splunk 7.x(Cloud) for apothuri. 06-05-2020 12:50 AM
- Karma Constant re-authentication after SSO migration for tjago11. 06-05-2020 12:50 AM
- Karma Re: can't read "splunkdestinationip_withrd": no such variable for prakash007. 06-05-2020 12:50 AM
- Karma Re: can't read "splunkdestinationip_withrd": no such variable for petom. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk SAML authentication - Data Confidentiality issue. 06-05-2020 12:50 AM
- Karma Re: How to index the message trace report with local timestamp for wstarowicz. 06-05-2020 12:49 AM
- Karma How to index the message trace report with local timestamp for dwangfeng. 06-05-2020 12:49 AM
- Karma Re: SAML authentication with LDAP authorization for cboston. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 1 |
01-03-2020
02:36 PM
Great step-by-step instructions. Thank you.
... View more
03-20-2019
10:21 AM
Ok, I guess we are getting into a semantics argument but I feel it's an important distinction. SAML is based on federations, a trusted relationship between the Identity Provider and the Service Provider. If the Identity Provider is no longer trusted then that trust is revoked by the Service Provider. The point I'm clarifying is that it's the Service Provider makes the authorization decisions, not the Identity Provider.
... View more
The way we are integration with SAML is incorrect?
Did you setup role mapping with your SAML integration? Your Identity Provider passes an attribute that contains the splunk role the user should belong to:
https://docs.splunk.com/Documentation/Splunk/7.2.4/Security/Mapgroupstoroles
Can we control user authorization on the splunk side?
Yes, look at the authentication.conf spec:
https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Authenticationconf
defaultRoleIfMissing = <splunk role>
* OPTIONAL
* If the IDP does not return any AD groups or splunk roles as a part of the
assertion, we will use this value if provided.
Create a role with no permissions as the default role.
... View more
03-18-2019
09:08 AM
When you set up SAML you are essentially saying 'I trust this authentication provider to authenticate and authorise users on my system'
This is incorrect. The role of the Authentication provider is to verify that the user is who they say they are. The role of the Service Provider (Splunk) is to authorize who has access to this system.
... View more
01-14-2019
07:20 AM
Sorry, this wasn't a splunk issue. I logged a case with F5 and it turned out to be an issue with the iApp. They have released v3.7.2rc5 of the iApp to address this.
... View more
12-18-2018
01:11 PM
If you are seeing some events but not others then the first troubleshooting step is to SSH to the F5 LTM and look at /var/log/ltm to see if there are any errors with the transfer to splunk.
... View more
12-18-2018
01:05 PM
ssh to the F5 LTM, look at /var/log/ltm to see if there are any errors with the transfer to splunk
... View more
12-18-2018
01:02 PM
Yes, the iapp can push to heavy forwarders instead of indexers
... View more
12-18-2018
01:00 PM
Yes, you could configure the F5 iapp to push events to heavy forwarders instead of indexers.
... View more
12-18-2018
12:48 PM
We are running Splunk v7.2.1 on-premise with F5 LTM v11.5.4. We are seeing some F5 events in splunk (source=bigip.snmptrap and source=bigip.syslog) but we suspect that we are missing a great deal more. The following is logged in the F5:/var/log/ltm:
Dec 18 04:20:19 slot1/my-f5-ltm err scriptd[8262]: 014f0013:3: Script (/Common/analytics-iapp_splunk-send_stats1) generated this Tcl error: (script did not successfully complete: (can't read "splunkdestinationip_withrd": no such variable while executing "string compare "$splunkdestinationip_withrd" "0" " ("Splunk" arm line 5) invoked from within "switch -- $format { "Splunk" - "F5 Analytics" { catch {exec /bin/gzip $filename$i$ext -f} ..." ("for" body line 4) invoked from within "for {set i 0} {$i <= $currentfile} {incr i} { set curl_response "fail" set ext "" switch -- $format { ..." line:2619))
Dec 18 04:20:19 slot1/my-f5-ltm err mcpd[8429]: 0107167d:3: Data publisher not found or not implemented when processing request (unknown request), tag (2901).
We do have the correct IP and port listed in "Analytics System Configuration" section and we are seeing some F5 events. Any idea how to fix these errors?
... View more
07-16-2018
07:33 AM
Is SAML the better choice for authentication?
It depends. Does your environment already run ADFS or some other product that can talk SAML?
If you're already leveraging SAML in your institution then you can take advantage of true SSO. If not then just authenticate using LDAP. A SAML Identity Provider is not a trivial thing to get up and running. Of course, I'm assuming that your splunk instance is on-premise or, if it's splunk cloud, then your security policy allows ldap connections from outside your domain.
SAML is definitely something to look into (in the future) as it's inherently more secure.
... View more
05-01-2018
07:52 AM
Please post your $SPLUNK_HOME/etc/system/local/authentication.conf
... View more
05-01-2018
07:48 AM
Hi @hthairu, we need some more info:
Have the SAML users already logged in? (ie. Are their accounts already in splunk)
Do you run a search head cluster or are they standalone search heads.
... View more
05-01-2018
07:47 AM
Hi @deepashri, this will only work if the SAML user has logged in already.
... View more
12-06-2017
07:16 AM
@mlevsh
Did you find out what your problem was?
... View more
11-30-2017
11:32 AM
https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/ConfigureSAMLSSO#Configure_your_identity_provider
Note that you can export Splunk software metadata using the /saml/spmetadata endpoint on Splunk Web. You can also access the SAML-sp-metadata endpoint on splunkd.
@mlevsh
Go to https://yoursplunk.yourdomain.com/saml/spmetadata to generate your metadata. Compare this with the file you provided to Ping Identity. Is it the same?
... View more
11-30-2017
10:45 AM
Which IdP are you using?
Try to generate your spmetadata.xml again on the upgraded search head and compare with the original spmetadata file you gave to your IdP. Is it the same?
... View more
11-30-2017
06:43 AM
Can you not just read the $SPLUNK_HOME/etc/system/local/authentication.conf file with your python script? If not then look at using web services to read this file:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/RESTTUT/RESTconfigurations
... View more
To login with a local user:
https://mysplunk.myfqdn.com:8000/en-US/account/login?loginType=splunk
... View more
11-24-2017
06:56 AM
Great, once you change the settings in your authentication.conf you'll have to restart your Splunk instance or reload the authentication config. Then you'll need to regenerate your SPmetadata.xml and confirm that XML has the new certs. Then you'll need to pass this to your IdP.
Let me know if you have any further questions. If not, please accept this answer.
... View more
11-24-2017
06:45 AM
Yes, it's possible as long as your web application firewall can talk SAML. Take a look at Configuring Single Sign-On with reverse proxy. This doc shows how you offload SAML to your web app.
... View more
11-24-2017
06:39 AM
I'm not sure if you're referring to changing the certificate of your Identity Provider or your Splunk Service Provider. Take a look at the authentication.conf spec.
The settings you're looking for are idpCertPath, clientCert, and caCertFile.
... View more
11-09-2017
09:34 AM
What's the purpose of your apache proxy? Why not connect to the splunk servers directly?
... View more
11-09-2017
07:54 AM
ltm pool /myPartition/traf_splunk_https_pool {
description "Splunk Clustered Search Head Pool"
load-balancing-mode predictive-member
members {
/myPartition/splunk1_node:8000 {
address 192.168.0.11
}
/myPartition/splunk2_node:8000 {
address 192.168.0.12
}
/myPartition/splunk3_node:8000 {
address 192.168.0.13
}
}
monitor /myPartition/https_splunk_8000
}
ltm virtual /myPartition/traf_splunk_https_vs {
description "Splunk Clustered Search Head"
destination /myPartition/192.168.12.12:443
ip-protocol tcp
mask 255.255.255.255
persist {
/myPartition/splunk_sourceaddr-persistence-profile {
default yes
}
}
pool /myPartition/traf_splunk_https_pool
profiles {
/Common/tcp { }
}
rules {
/myPartition/restrictToInternal_irule
}
source 0.0.0.0/0
source-address-translation {
type automap
}
translate-address enabled
translate-port enabled
}
... View more
11-06-2017
12:37 PM
Thanks, can you post the metadata generated from this config?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
