Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About sivagct
sivagct
Explorer
Member since:
10-30-2017
07-26-2024
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-30-2017 |
Activity Feed
- Posted How do I add the AWS account into the Splunk AWS add-on using IAM role? on All Apps and Add-ons. 07-21-2024 07:18 PM
- Got Karma for SAML SSO on search head cluster behind load balancer. 06-05-2020 12:49 AM
- Posted Re: Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-23-2018 07:05 AM
- Posted Re: Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-23-2018 06:09 AM
- Posted Re: go to a specific page after SSO login on Security. 03-22-2018 07:35 PM
- Posted Re: Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-22-2018 11:46 AM
- Posted Re: Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-22-2018 08:02 AM
- Posted Re: Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-22-2018 07:12 AM
- Posted Re: Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-22-2018 06:58 AM
- Posted Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-22-2018 06:37 AM
- Tagged Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-22-2018 06:37 AM
- Tagged Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-22-2018 06:37 AM
- Tagged Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-22-2018 06:37 AM
- Tagged Why is the Splunk SAML SSO unable to open direct email link? on Reporting. 03-22-2018 06:37 AM
- Posted Re: SAML SSO on search head cluster behind load balancer on Deployment Architecture. 11-09-2017 09:00 AM
- Posted Re: SAML SSO on search head cluster behind load balancer on Deployment Architecture. 11-09-2017 05:45 AM
- Posted Re: SAML SSO on search head cluster behind load balancer on Deployment Architecture. 11-06-2017 01:16 PM
- Posted Re: SAML SSO on search head cluster behind load balancer on Deployment Architecture. 11-06-2017 12:28 PM
- Posted Re: SAML SSO on search head cluster behind load balancer on Deployment Architecture. 11-02-2017 06:47 PM
- Posted SAML SSO on search head cluster behind load balancer on Deployment Architecture. 10-30-2017 06:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 |
07-21-2024
07:18 PM
Hello I have installed the Splunk add on for AWS on our on perm Splunk instance. Using IAM User is not allowed in our company due to security policy. We can only use IAM role to access the resources. In Splunk aws addon page, Under configuration tab, Adding AWS account in Splunk requires KeyID/secret key which I can not create due to my company policy.. Is there a way to connect to the AWS account using IAM role that has the Splunk inline policy attached to it? Thanks in advance. Siva
... View more
Labels
- Labels:
-
configuration
03-23-2018
07:05 AM
yeah, that's the workaround and it works that way. However, I am not logged into Splunk all day and also session won't be active all the time. It's kind of inconvenience for the users to click twice to see the exact page.
... View more
03-22-2018
07:35 PM
How did you fix this? please share. Facing the problem after we swtiched from LDAP to SAML SSO. It always redirects to the home page after authentication not to the actual page.
... View more
03-22-2018
11:46 AM
Hello,
Sorry it did not work, it is still the same. Whenever it does the SSO, it always redirect to the http:////en-US/app/portalinsight/search and we need to click the link again to see the results page.
... View more
03-22-2018
08:02 AM
We will make this change and test for the behavior. I will update you the status. Thanks for your help.
... View more
03-22-2018
07:12 AM
In the alert_actions.conf, we have the VIP name:port not the actual name of the searchhead server. We have three searchhead servers, it has the VIP name:port and splunk SSO works with the VIP.
... View more
03-22-2018
06:58 AM
yes, the email link has the hostname. Ideally, it should authenticate with SSO and then direct to the results page. Instead it takes us to the default search. We need to click the email link again to view the results keeping the same session.
... View more
03-22-2018
06:37 AM
Hello,
Since we switched to SAML SSO, we are unable to open Splunk links directly from our email. Every time I click on a link, it redirects to the Idp and authenticating and then displays portalinsight search page instead of results of the query. The email link works if I am already signed in but that is rare. I don’t have Splunk open most of the time.
Any ideas how to prevent this in SAML SSO?
Thanks in Advance.
... View more
11-09-2017
09:00 AM
Thanks. our setup is below how different from yours?
Wide IP
| \
DC1 VIP DC2 VIP
| \
apache proxy1 apache proxy2
| \
Splunksvr1:8000 Splunksvr2:8000
... View more
11-09-2017
05:45 AM
Can you share your LB setup? because I am not able to generate the metadata with my setup http:///saml/spmetadata I am able to generate using http://:8000/saml/spmetadata
... View more
11-06-2017
01:16 PM
Sorry, I can't access http://pastebin.com as this is blocked in our proxy.
... View more
11-06-2017
12:28 PM
Yes, if I generate the metadata from the pool members behind the VIP, SAMLworks.
Yes, our LB is F5. I think persistence is enabled. As of now, it works with LDAP perfectly. If you send me your email I can send the metadata file directly. I am not able to upload it here or use other file sharing tools.
... View more
11-02-2017
06:47 PM
We do not have SSL cert for our splunk instance. However, I have SSL cert of the federation URL copied under each search head server under this path $SPLUNK_HOME/etc/auth/idpCerts/
Below is the saml configuration from authentication.conf
[saml]
allowSslCompression = true
attributeQueryRequestSigned = false
attributeQueryResponseSigned = false
attributeQueryTTL = 3600
entityId = WebPortalSplunk
fqdn = http://webportalsplunk
idpSSOUrl = https://federationuat.client.bcorp.com/idp/startSSO.ping?PartnerSpId=WebPortalSplunk
maxAttributeQueryQueueSize = 100
maxAttributeQueryThreads = 2
redirectPort = 8000
signAuthnRequest = false
signedAssertion = false
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2
Thanks
... View more
10-30-2017
06:50 AM
1 Karma
I have been trying to configure SAML SSO for the search head clusters running behind the LB. Our setup is Splunk WIP (wide IP Port 80) --> two VIPs in each DC which has Splunk search head servers under then listening on port 8000.It is working fine with LDAP settings.
We are able to get SSO working by generating the metadata from the individual search head server listening on port 8000. However Load Balancing is not working since it always redirects to the same server where we generated the metadata. How we have generate a saml metadata file such that SAML SSO works with Wide IP? like how it is working with LDAP.
I tried changing the saml/acs URL to the WIP but it doesn't work.
Does anyone come across this situation? any ideas how to deal with this>
Thanks in Advance,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-26-2024
03:59 PM
|
