About proxy single sign-on

Proxy single sign-on, or proxy SSO, is an authentication method that lets you configure single sign-on authentication for Splunk Enterprise instances through a reverse proxy server.

With proxy SSO, a proxy server exists between the Splunk Enterprise deployment and an external authentication service. You can pass user identity and group information in HTTP headers from the proxy server to Splunk Enterprise. Splunk Enterprise uses the information it receives in these headers to authenticate users and subsequently authorize them through groups that have been mapped to Splunk roles.

Authentication using proxy SSO provides the following benefits:

• It combines authentication and authorization into one step for the user, which streamlines the login process
• It eliminates a direct connection between Splunk Enterprise and the external authentication service, which increases security
• It reduces the number of configuration steps for authentication
• It lowers the amount of network communication between Splunk Enterprise and authentication services, making authentication more efficient
• It expands the number of authentication service options you can use beyond Lightweight Directory Access Protocol (LDAP), as the proxy server passes the required authentication and authorization information

It's not possible to configure proxy SSO in Splunk Enterprise using Splunk Web. Instead, you must use the Representational State Transfer (REST API) or modify configuration files, as described in Configure proxy single sign on.

Splunk Cloud Platform does not support authentication using proxy SSO.

Prerequisites to configuring proxy SSO

To set up proxy SSO, you must have the following:

• A proxy server
  • This proxy server must be configured to send HTTP headers as part of an HTTP web request or response.
• A working Splunk Enterprise deployment

For more information about how to configure these items and set up proxy SSO, see Configure proxy SSO.

How proxy SSO works

1. You configure a proxy server to handle authentication requests between Splunk Enterprise and an external authentication service.
2. You map groups on the external application service to roles on the Splunk Enterprise deployment.
3. The proxy server authenticates against the configured authentication service and creates an HTTP request.
4. Splunk Enterprise receives HTTP headers from the trusted reverse proxy server.
5. Splunk Enterprise checks the trustedIP setting in its web.conf configuration file to determine that it is receiving a request from the trusted proxy server IP address.
6. Based on the headers that Splunk Enterprise receives from the trusted proxy server, Splunk Enterprise accepts or denies the login request.

After a successful login, the client web browser creates a session cookie and the user can then access Splunk Web.