Security

LDAP Authentication Splunk Free broken since update to Splunk 6

pixelseventy2
Explorer

Hi. I am currently running Splunk Free. In order to provide some access control, it is proxied through Apache on the same server, with LDAP authentication. This was working perfectly until I updated to Splunk 6 this morning. Now I am unable to access Splunk, as it keeps prompting for credentials. I've even tried changing to file-based passwords, with the same issue.

Here is my Apache config:

ProxyPass           /       htp://localhost:8000/ retry=0 timeout=5
ProxyPassReverse    /       htp://localhost:8000/

[Location /]
            AuthType Basic
            AuthName "Splunk"

            AuthBasicProvider ldap
            AuthzLDAPAuthoritative  On
            AuthLDAPBindDN "cn=ldap-bind,ou=Service Accounts,...,dc=co,dc=uk"
            AuthLDAPBindPassword "..."
            AuthLDAPUrl "ldap://10.10.10.10:389/ou=...,dc=co,dc=uk?sAMAccountName?sub?(objectClass=user)" NONE
            AuthLDAPGroupAttributeIsDN on

            Require ldap-group CN=G.ADM.Logging,OU=Admin,...DC=co,DC=uk
[/Location]

Has anyone else experienced this issue? If I disable authentication it proxies fine again.

(Note, the typos above are because I can't post otherwise.)
Thanks.

Tags (1)

elatov
New Member

Are you referring to Chrome bug ID 6666?

0 Karma

ithangasamy_spl
Splunk Employee
Splunk Employee

it is known bug in 6.0 on Chrome .

0 Karma

itghelp
Path Finder

Hi @pixelseventy2, yes, only Chrome seems to be affected.

0 Karma

pixelseventy2
Explorer

Hi @itghelp, are you seeing the issue on Chrome only, or on all browsers?

Thanks.

0 Karma

itghelp
Path Finder

I'm also experiencing this issue on 6. I had it on 5, but managed to mess with the proxy settings until it worked. Trying to login with the correct user/pass just results in the authentication prompt reopening. Hitting "cancel" just gives me a 401.

I'm using nginx to reverse proxy.

0 Karma

pixelseventy2
Explorer

Hi Drainy. No, it just keeps popping up the Apache basic authentication box, seemingly for each HTTP request.

Thanks.

0 Karma

Drainy
Champion

Are you saying that its now asking for a Splunk user/pass after passing your LDAP authentication?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...