Copyright 2015 Splunk Inc. Securing Splunk with Single Sign On & SAML Nachiket Mistry Sr. So=ware Engineer, Splunk Rama Gopalan Sr. So=ware Engineer, Splunk
Disclaimer During the course of this presentajon, we may make forward looking statements regarding future events or the expected performance of the company. We caujon you that such statements reflect our current expectajons and esjmates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward- looking statements, please review our filings with the SEC. The forward- looking statements made in the this presentajon are being made as of the Jme and date of its live presentajon. If reviewed a=er its live presentajon, this presentajon may not contain current or accurate informajon. We do not assume any obligajon to update any forward looking statements we may make. In addijon, any informajon about our roadmap outlines our general product direcjon and is subject to change at any Jme without nojce. It is for informajonal purposes only and shall not, be incorporated into any contract or other commitment. Splunk undertakes no obligajon either to develop the features or funcjonality described or to include any such feature or funcjonality in a future release. 2
Through 2016, Federated Single Sign- On Will Be the Predominant SSO Technology, Needed by 80 Percent of Enterprises. - Gartner 3
Sr. So=ware Engineer 5+ Years with Splunk rgopalan@splunk.com Rama Gopalan 4
Sr. So=ware Engineer 3+ Years with Splunk 5 Major Releases 50+ Maintenance Releases nmistry@splunk.com Nachiket Mistry 5
Agenda Why Single Sign On (SSO) Splunk SSO Splunk SSO with SAML 6
Wikipedia on Single Sign On 7
8
Why Single Sign On (SSO) Reduce administrajon Time savings for users Increase user adopjon Increased security 9
Configuring Splunk SSO 4 Step Process 10
Configuring SSO in Splunk 11
Configuring SSO in Splunk 12
Configuring SSO in Splunk 13
Configuring SSO in Splunk 14
1: Configuring LDAP 15
Configuring LDAP 16
Configuring LDAP 17
Configuring LDAP 18
Configuring LDAP 19
Configuring LDAP $ cat etc/system/local/authentication.conf [authentication] authsettings = OpenLDAP authtype = LDAP [OpenLDAP] host = myldaphost.splunk.com nestedgroups = 0 port = 389 binddn = cn=manager,dc=openldap,dc=splunk,dc=com... 20
Authorizing LDAP Users 21
Authorizing LDAP Users 22
Authorizing LDAP Users 23
Authorizing LDAP Users 24
Configuring LDAP $ cat etc/system/local/authentication.conf... [rolemap_openldap] admin = Static Help Admin;Static Sustaining Admin user = Nested Group 25
2: Configuring Reverse Proxy 26
Configuring Apache as Reverse Proxy $ sudo a2enmod proxy_http... ProxyRequests off ProxyPass / http://mysplunkhost:8000/ ProxyPassReverse / http://mysplunkhost:8000/... 27
3: Reverse Proxy Handles AuthenJcaJon 28
Apache & LDAP $ sudo a2enmod authnz_ldap ldap... AuthType Basic AuthBasicProvider ldap AuthName OpenLDAP AuthLDAPURL ldap://myldaphost.splunk.com:389/ou=people,dc=splunk,dc=com AuthLDAPBindDN "cn=manager,dc=openldap,dc=splunk,dc=com" AuthLDAPBindPassword password" require valid-user... 29
Finally: Enable SSO 30
Set the User Name Header $ sudo a2enmod rewrite... RewriteEngine on RewriteRule.* - [E=RU:%{REMOTE_USER}] RequestHeader set REMOTE_USER %{RU}e... 31
Enable SSO in Splunk $ cat etc/system/local/server.conf [general] trustedip = 127.0.0.1 $ cat etc/system/local/web.conf [settings] trustedip = 127.0.0.1,10.162.255.123 32
33
TroubleshooJng SSO /debug/sso 34
TroubleshooJng SSO 35
Splunk SSO with SAML 36
SAML 2.0 Security AsserJon Markup Language XML based standard for browser based SSO MulJple protocols and bindings IDP - IdenJty Provider - Trusted Authority, SP - Service Provider IDPs out there Ping IdenJty, Okta, OneLogin, Azure 37
Why SAML? Security q CredenJals are not stored locally q Standard for Single Sign On MulJ- Factor authenjcajon 38
Splunk and SSO - pre- SAML - with SAML [authenjcajon] authsepngs = saml_sepngs authtype = SAML
Configure Splunk
Export SP Metadata 41
The Login Process 42
Splunk(SP) User/Browser Ping IdenJty(IDP) 1.User accesses Splunk resource 2. Redirected to the IDP - AuthnRequest 3. IDP prompts the user for credenjals 5. IDP redirects back to Splunk, sends a SAML asserjon 5b. Session cookie of Ping 4. User enters credenjals 6. Splunk checks the role avribute in the asserjon and checks the role mapping 7. SUCCESS User logged in
Configure the IDP (Ping IdenJty) IDP inijated SSO, SP injated SSO, SP inijated SLO Avribute Query Request Supported Signed request/response Upload Splunk s cerjficate OR Import Splunk s metadata
Configure Ping for SSO 45
Avributes in the SAML asserjon 46
Why Avribute Query? When saved searches need to run Splunk uses the avribute query url using basic auth and queries the IDP IDP returns avributes - mainly AD group informajon Splunk uses the role mapping and creates a session for the user
Set up SHC with SAML Configure all search heads with SAML AddiJonal sepngs if there is a proxy or load balancer Single logout - search heads share a Ping session index
Q & A
THANK YOU