Hey Everyone.
Been running splunk behind an apache proxy with NTLM for awhile. (Same host). Today, I decided to move the apache proxy to a different server, and use SAML2.0 as the authentication method.
As fast as /debug/sso goes, this was a no-hiccup change. As far as the actual web interface goes, it tells me:
Could not authenticate user via SSO. Please confirm the user set in the http header via your SSO module has a matching splunk account with the same username.
I verified the usernames, which now uses userprinciplename, instead of samaccount. I can log in using :8000 fine.
Are there some other logs I can get into to help me diagnose this further?
The debug page is perfect.
Is the incoming request IP in splunkweb's list of trustedIPs? Yes. SSO will be used to authenticate this request.
Remote User HTTP Header REMOTE-USER
Value of REMOTE-USER jgauthier@lastar.com
Thanks!