Why am I unable to log in to the Splunk Mobile App using iOS (iPhone)?

[dfigurello]

Hi splunkers,

I am doing a POC on a customer and the last test was mobile access using Android and iOS devices through SSL VPN.
For the customer we installed Splunk Enterprise 6.5 and the Splunk Add-on for Mobile Access version 2.4.

First of all, with Android devices, the test was all ok using VPN SSL, but when I tried using iphone 7 (IOS), I could not sign in.
The message was:

Sign in Failed. Login Failed. Contact
your system administrator.

To test, I connected to his internal network (same network of Splunk server) and the error happened again.

My app configuration is:

user: admin
Host URL: http://10.32.20.61:8000

Let me know if you guys need more information.

Cheers,

[teleworm12]

I am also faced the same issue

[xxdesmus]

I solved this problem by installing this app: "Splunk Add-on for Mobile Access"

After installing that app (and restarting) the iOS app immediately connected without issue.

[xxdesmus]

I still can't get this actually work. iOS 10.2

I know I have the right username and password. I'm using a domain name for the server location. Any other ideas?

I can reach the server and login without issue via a browser on my phone.

[roym_splunk]

Hi xxdesmus:
When you fail to log in, there will be a pop-up dialog, showing that you can send the log. Could you please send your log to mobileaccess-support@splunk.com. We can investigate your issue.

[xxdesmus]

@roym -- see below, I installed this app: "Splunk Add-on for Mobile Access" and now it's working

[roym_splunk]

Hi:
We've found the root cause of this issue.
If your device is running iOS 10, please assign a hostname or domain name for your splunk (by setting up the DNS or Proxy Server, etc). On iOS 10 devices, in the login page of the Splunk Mobile App, the host with ip address will be resolved wrongly.
Or you can try it on your iOS 8.x, 9.x devices.

[dfigurello]

Hi Roy,

I will test it, tks for your help.
I am waiting my username to open a ticket on the Splunk Portal. 😉

Cheers!

[zakxu8]

Hi, dfigurello

how are you? how your problem? any solution?
if you have a solution for this issue please tell me.
i have same a problem, my splunk unable connect with splunk mobile apps for iphone. thank you

[dfigurello]

Hi folks,

I installed a new environment on my computer using linux debian, splunk enterprise 6.5 and splunk add-on for mobile version 2.4 to simulate the scenario. I installed on a new iphone (iphone 6 and IOS 10 ) and I did download the splunk app on appstore but the error happened again.

I don't know but I think there is a bug with a new version using iphone models.

This scenario I did not use VPN.

Cheers,

[ehope67]

I'm having same problem...works with android, doesn't with iphone. Are there any conclusions to the problem discussed on this thread?

[cmerriman]

Im on iOS10 and after I login to my vpn, my Splunk app works with this: https://{URL}:8089

Just like if I were connecting from my home computer on a vpn and can't just type in Splunk:8000.

[mattymo]

That depends...

You can use 8000 on VPNs that allow you to do so.

I have never used 8089 as the means to connect. Always splunkweb port.

Off to read the docs I go...

[teleworm12]

Thanks for this I loved your work. Recently I want to delete the application of the Kindle app from my iPhone that's I want to know how to remove books from kindle so any suggestion for me please assist me. I already visit a website:- www.ipadsupportnumber.com/blog/how-to-delete-books-from-kindle-on-ipad-and-iphone/

[roym_splunk]

Hi:

I've tried connect in same network's
splunk without firewall, but the error
had happened.

Did you try it by the browser on your mobile device? or the browser on the desktop?
Please enable the VPN as you did for the mobile app, then use the safari on the iPhone to open the http://10.32.20.61:8000, to check whether it works or not.

If it works, please try this URL still by the safari on your iPhone with VPN on:
http://10.32.20.61:8000/en-US/custom/mobile_access/proxy/services/mobile-access/ma-status?output_mod...

Tell us whether it returns or not.

Thanks

[mattymo]

cool, is that a general health check endpoint?

what should we look for?

[roym_splunk]

The web page encode the above URL. so please try this

http://10.32.20.61:8000/en-US/custom/mobile_access/proxy/services/mobile-access/ma-status?output_mod...

It checks the existence of the mobile add-on

[dfigurello]

Hi Roy,

The result was 404 not found.
I tried in same network's splunk without firewall, but the error had happened.

Just for information, I can access using android devices using the app.
The issue happens just on iphone devices.

[mattymo]

Hey dfigurello!

I am seeing a similar behavior. I can take VPN out of the equation in my case. My hunch is the iOS app itself.

Set up:

iOS10.0.0.2
Splunk Mobile App & Splunk Add-on for Mobile Access 2.4
Splunk 6.5 standalone SH serving port self signed certs to the net on :8000

I am able to connect to the SH via safari on iphone using port 8000, despite the app failing. Are you able to reach the splunk search head in your iphone browser?

If not, are you configuring ios thru the custom VPN settings or using a client?

I see 8000 blocked in plenty of orgs. You could serve splunk on 443 on an instance if that ends up being the case as well.

oh FYI! If you click on 'Contact Us' on the sign-in failure, you can submit logs to the support team!

[UPDATE]

found this in the splunk startup blurb after rolling back my self signed certs to stock. may be unrelatedd..still checking...

    Checking conf files for problems...
        Invalid key in stanza [expose:pdfgen/render] in /opt/splunk/etc/apps/mobile_access/default/mobile_access_settings.conf, line 222: timeout  (value:  300).
        Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
    Done

[UPDATE 2]

cleaned up the startup error by commenting out the invalid timeout key. unrelated to the larger login issue....

rollback self-signed certs to Splunk default cert. Still nadda. May try http shortly...

[UPDATE 3]

I Bounced the Searchhead VM and cleaned up a few apps and I am back in business.

Now able to connect without issue. Will dig for root cause if possible...

[FINAL UPDATE]

Reviewing the mobile access internal splunk logs, it looks like the requests were not hitting the REST endpoint...or the mobile access proxy was down....either way....im back online. The mobile access add on has a good report for watching from the server side, called 'proxy REST API Access'

| `rest_api_access("*")` | sort 1000 - _time

Once I saw no activity hitting the server, I went back an reviewed the logs I sent to the mobile team that the feedback link on the login failed prompt led me to, and the logs definitely capture my failures...will let you know if they lead me to the exact root cause.

 NSErrorFailingURLKey=https://hostname:8000/services/server/info?output_mode=json, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-2102, NSLocalizedDescription=The request timed out.}): https://hostname.:8000/services/server/info?output_mode=json��
I�

NSLocalizedDescription=Request failed: not found (404)}): https://hostname.:8000/en-US/custom/mobile_access/proxy/services/mobile-access/ma-status?output_mode... ��
I�


NSLocalizedDescription=Request failed: internal server error (500)}): https://hostname:8000/en-US/custom/mobile_access/proxy/services/mobile-access/ma-status?output_mode=... ��
3�

Anyhow, sorry for all the reading 😉 fun adventure learning how to troubleshoot this!

[dfigurello]

Hi mmodestino,

Tks for your comment.

Are you able to reach the splunk search head in your browser?

Yes, i can.
After I've tried connect in same network's splunk without firewall, but the error had happened.

Cheers.

[mattymo]

As long as you have the IP you expect to have via VPN, the best test is accessing the searchhead via safari on the iphone. If you can connect from the browser, you should be ok from the app.

Not sure what was causing my attempts to fail, but I am wondering if I had a process that dead before I rebooted my machine.