Search
  • Todd Waller

SSO, Splunk and Troubleshooting v2

Hello Everyone


In the last post we talked about setting up and testing SSO with Splunk.


In my deployment this setup and configuration went great......minus one detail we hand't thought about.


When authenticating users,as well as power users, accounts worked great.


The problem we ran into that we didn't initially think of was that as Splunk Administrators we used a separate account to authenticate into Splunk with. So when we would SSO into Splunk it would authenticate us as our user/power user accounts and not our Administrator accounts.


We had several options on how to handle this but the workaround that we settled on was creating creating a privileged workstation we could RDP to and access Splunk web from there using our new privileged Administrator SSO credentials.


Once we did this we had to move our knowledge objects from the previous Administrator credentials. This was really easy using the web UI. You can do this by going to: Settings -> All Configurations -> Reassign Knowledge Objects


There you can use filters to find all of your knowledge objects and select/change the en mass.


The other thing to remember is that there is always a backdoor once SSO is enabled that you can use to login:

https://yoursplunkurl:8000/en-US/account/login?loginType=splunk



These were just a few things we encountered and worth noting for the rest of you in case you may encounter some of these things yourself.


Thanks!

Have a great weekend!


-Todd

24 views0 comments

Recent Posts

See All

So I've been thinking today about how useful Splunk is on the "blue" side of the house. What about the Purple and Red side? What features would Splunk need to gain to add value to the other 2/3rds of