Security

logging in with local admin while SSO is enabled.

anoopambli
Communicator

We have splunk instance enabled with SSO using CA siteminder. The user authorization is using splunk user config. All users configured with splunk are able to authenticate and authorize correctly. Keeping SSO enabled, is there anyway we can login to splunk using the local admin account of splunk?

We are accessing splunk via the proxy URL and direct URL of splunk would give SSO error.

this is the web.conf and server.conf configuration

web.conf
[settings]
\#SSO
SSOMode = strict
trustedIP = 10.93.171.10
remoteUser = Corpid
\#tools.proxy.on = true

server.conf
[general]
trustedIP=127.0.0.1

Tags (1)
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

You can login with the local admin user. You need to set SSOMode = permissive.

Permissive: Requests to Splunk Web that originate from an untrusted IP address
are redirected to a login page where they can log into Splunk without using SSO.

View solution in original post

linu1988
Champion

You can with your default splunk web access port. which is by default 8000. Splunk authenticated user will be able to access through this. Others can use SSO like you have configured.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You can login with the local admin user. You need to set SSOMode = permissive.

Permissive: Requests to Splunk Web that originate from an untrusted IP address
are redirected to a login page where they can log into Splunk without using SSO.

anoopambli
Communicator

So that means once you have SSO enabled, you cant use the local account as that is not bound with any domain user account for authentication. The option left is to assign admin roles to one of the domain user who can authenticate. Is that correct?

0 Karma

linu1988
Champion

I guess it's not possible. You can assign one user, admin privilege. the local admin can access through splunk web default port. As LDAP will not find any name "admin" in your groups i suppose it's not possible.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...