About ProxySSO

ProxySSO is an authentication method that lets you configure Single-Sign On (SSO) for Splunk instances through a reverse proxy server. A user logged in using SSO can seamlessly access Splunk Web.

With ProxySSO Single-Sign On, user identity and group information can be passed in HTTP headers to Splunk Enterprise. Splunk Enterprise uses this information to authenticate users and authorize them by mapping groups to appropriate Splunk Enterprise roles.

ProxySSO authentication:

• Combines authentication and authorization into one step for the user, streamlining the login process.
• Reduces configuration steps. No need to configure complex LDAP strategies within Splunk Enterprise.
• Reduces the back and forth messages between Splunk Enterprise and authentication services, making authentication more efficient.
• The external authentication service is not restricted to LDAP as long as the proxy server can pass the required information.

ProxySSO cannot be configured through Splunk Web. Instead you must use the REST API or modify configuration files as described in Configure ProxySSO.

Splunk Cloud does not support ProxySSO.

Prerequisites

To set up ProxySSO, you should already have the following configured:

• A Proxy Server configured to send required HTTP headers.
• A working Splunk Enterprise configuration.

For more information about how to configure these items and set up ProxySSO, see Configure ProxySSO.

How it works

1. The proxy server authenticates against the configured authentication service and creates an HTTP request.
2. Splunk Enterprise receives HTTP headers from the trusted reverse proxy server.
3. Splunk Enterprise checks trustedIP (which is configured in web.conf) for a receiving request from the proxy.

After a successful login, a session cookie is created and the user can seamlessly access Splunk Web.