I have Splunk v4.2.2 configured for SSO using an external CAS gateway with an Apache reverse proxy.
I've had to set a remoteUser other than 'REMOTE_USER' to get this far, but it appears to be working/accepted to the point where Splunk isn't correlating the HTTP header remoteUser to the local splunk account.
I'm getting an error:
auth:56 - getSessionKey - unable to login; check credentials
decorators:192 - Could not authenticate user XXXXXXX via SSO. Does XXXXXXX have a matching splunk account with the same username?
I'm able to log into the Splunk port with the same local account, but logging in via the proxy/CAS server doesn't find the same local account for the userid that's being delivered in the Remote User HTTP Header.
The information in the debug/sso page all looks correct/accepted. Incoming request IP is trusted and the HTTP header/value for the remote user is correct.
I have no idea how to further debug this.
Is there a known fix for this, or a way to add any more details to the debug info via mrsparkle code?
... View more