Splunk:如何启用Splunk SSO

Question

我有splunk，并尝试启用splunk SSO而不是nornal身份验证。我有如下配置：

在/opt/splunk/etc/system/local/server.conf中

[general]
trustedIP = 192.168.1.208
serverName = Splunk_Core_02
pass4SymmKey = $7$RRvdYDdIlj4P2geQdtHluTRb7OfvZhTFTZGJ7z5JiZAkJ6Q1at6j0Q==
sessionTimeout = 30s

[sslConfig]
sslPassword = $7$m6pB5a0PWFg64VlNZGgunhGElO3qLiAc6NrhfLO+tpX2jR7WC7qm1Q==

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[license]
active_group = Enterprise

[diskUsage]
minFreeSpace = 1024

[lmpool:test_splunk]
quota = MAX
slaves = *
stack_id = enterprise

在/opt/splunk/etc/system/local/web.conf中

[settings]
#SSO
SSOMode = permissive
trustedIP = 192.168.1.208,192.168.2.15,127.0.0.1
remoteUser = REMOTE-USER
#tools.proxy.on = False

root_endpoint = /splunk

#SSL
enableSplunkWebSSL = 0

httpport = 8000

mgmtHostPort = 127.0.0.1:8089

appServerPorts = 8065

splunkdConnectionTimeout = 30

enableSplunkWebClientNetloc = False

# SSL certificate files.
privKeyPath = $SPLUNK_HOME/etc/auth/splunkweb/privkey.pem
serverCert = $SPLUNK_HOME/etc/auth/splunkweb/cert.pem

...

我看到http://192.168.1.208:8000/debug/sso页面，我看到单点登录没有启用。我的配置有什么问题？

Answer 1

在server.conf中有几个文档说，trustedIP就是127.0.0.1。但他们都没有提到只有127.0.0.1有资格启用/激活SSO。因此不要配置其它IP地址，而要配置127.0.0.1。

在server.conf(/opt/splunk/etc/system/local/)中，您可以配置one trustedIP，它是127.0.0.1。

Answer 2

https://docs.splunk.com/Documentation/Splunk/8.0.3/Security/ConfigureSplunkSSO

进行这些更改后，您是否重新启动了splunk？

在/opt/splunk/etc/system/local/web.conf中，remoteUser = REMOTE-USER更像是REMOTE_USER

Answer 3

你必须使用SAML..我正在使用SAML进行单点登录。您需要联系IT人员，他会为您提供IDP文件，上传该文件并与您的Splunk连接文件共享。你可以从同一个窗口下载它。转到用户->身份验证方法> SAML。放置好所有内容后，您必须在AD上创建组，并在SAML配置下的Splunk上执行相同的操作。如果你需要更多的细节，请告诉我。

https://docs.splunk.com/Documentation/Splunk/8.0.3/Security/HowSAMLSSOworks