Here are the configurations I am using: web.conf [root@searchead01 local]# cat web.conf [settings] updateCheckerBaseURL = 0 enableSplunkWebSSL = true splunkdConnectionTimeout = 10800 sslVersions = *,-ssl2,-ssl3,-tls1.0,-tls1.1 cipherSuite = TLSv1.2:!eNULL:!aNULL ecdhCurves = prime256v1,secp384r1,secp521r1 dhFile = /opt/splunk/etc/auth/splunkweb/dh2048.pem allowSslCompression = false enableWebDebug = true x_frame_options_sameorigin = False remoteUser = REMOTE_USER remoteGroups = REMOTE_GROUPS remoteUserMatchExact = 0 remoteGroupsMatchExact = 0 SSOMode = strict trustedIP = 127.0.0.1,10.20.30.40 authentication.conf [root@searchhead01 local]# cat authentication.conf [authentication] authType = ProxySSO authSettings = ssosettings [ssosettings] idpSLOUrl = https://Path/To/Custom/logout.html redirectAfterLogoutToUrl = https://Path/To/Custom/logout.html [roleMap_proxySSO] splunkrole1 = cn=activedirectorygroup1 splunkrole2 = cn=activedirectorygroup2 splunkrole3 = cn=activedirectorygroup3 ... View more

If HF only use to receive and forward data to Indexer, HF can be to ignore? ... View more