SSO with smartcards?

[Jaci]

We are using an Apache(2.2.16) proxy to achieve SingleSignOn and would like it to use our company smartcards.

The proxy is setup to use SSL and forward the smartcard username in the REMOTE-USER variable, but no SSO occurs.

Splunk log says: "No sessionKey session variable set"

[andrewbeeber]

Hi everyone,

Just in case, I found the following article on setting up Microsoft URL Rewrite to act as a reverse proxy server for Splunk very helpful.

http://blogs.msdn.com/b/chiranth/archive/2014/08/03/application-request-routing-part-2-reverse-proxy...

[hammon0u]

I am trying to accompolish the same thing, one thing I have found the smart card username is not in the same format that a traditional username. The identifying information for a client certificate is in x.400 format so the user identifying data is generally the Subject of the certificate in the form of somthing like this.

CN="John Doe",OU=Users,DC=domain,DC=com

There can be other certificate attributes if you collect them at enrollment time like Common Name which is just the CN portion of the above string. To get this to work you would have to have the username directory Splunk uses match the username string to exactly what is passed via the REMOTE-USER string. The 2 ideas I have has was do an LDAP query of the user based on the subject string to get the samaccountname from LDAP (Active Directory) and pass that to splunk as the REMOTE-USER or to setup the LDAP stradegy in Splunk (The directory of usernames to check the REMOTE-USER against) to use the CN for the user name attribute. The issue I am finding is that the username in the format of john.doe or jdoe is just not a standard part of the certificate and you can only pass information to the REMOTE-USER variable that you have.

My fear with querying for the samaccountname is that SSO checks for every action so it will do alot of queries against LDAP. I have not been able to get this to work yet but this is what I have discovered so far in trying to get SmartCards to work.

[gkanapathy]

All you need to do in this case is set the "User Name Attribute" in Splunk to be the name of the attribute that contains the corresponding value in the REMOTE-USER header, e.g. "distinguishedName", rather than "sAMAccountName" or "uid". This does mean that logging in to Splunk will require that string (rather than a short user name), but if you have SSO it shouldn't matter for your users.