1

I am trying to configure SSO from an IdP to Apache with mod_mellon and mod proxy to splunk.

Environment: Ubuntu 14.04; Apache 2.4.7; mod-auth-mellon 0.7.0.

Apache configured with the mellon-generated key / cert on default ssl site. mod proxy is being used to proxy to splunk locally on port 8000.

auth_mellon.conf:

MellonCacheSize 100
MellonLockFile "/var/lock/mod_auth_mellon.lock"
MellonPostDirectory "/var/cache/apache2/mod_auth_mellon/"

ProxyRequests Off
ProxyPass /secret/ !
ProxyPassInterpolateEnv On
<Location />
        MellonEnable "info"
        Require valid-user
        AuthType "Mellon"
        MellonVariable "cookie"
        MellonSamlResponseDump On
        MellonSPPrivateKeyFile /etc/apache2/mellon/urn_splunk.key
        MellonSPCertFile /etc/apache2/mellon/urn_splunk.cert
        MellonSPMetadataFile /etc/apache2/mellon/urn_splunk.xml
        MellonIdpMetadataFile /etc/apache2/mellon/idp-meta.xml
        MellonEndpointPath /secret/endpoint
        MellonUser "NAME_ID"
        MellonDefaultLoginPath /en-US/
        RequestHeader set SplunkWebUser %{MELLON_NAME_ID}e
        MellonSamlResponseDump On

        ProxyPass http://127.0.0.1:8000/
        ProxyPassReverse http://127.0.0.1:8000/
        ProxyPassInterpolateEnv On
</Location>

idp-meta.xml contains the metadata from the IDP (including the IDP x509 cert and HTTP Post / HTTP Redirect parameters). the urn_service.* files are generated from a mellon_create_metadata.sh script that creates an x509 cert and key on the SP and xml config file.

When I try access the splunk from the IdP, I see errors in the apache log file, and get a 500 / internal server error response:

[authz_core:debug] mod_authz_core.c(802): AH01626: authorization result of Require valid-user : denied (no authenticated user yet)
[authz_core:debug] mod_authz_core.c(802): AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[core:error] AH00027: No authentication done but request not allowed without authentication for /secret/endpoint/login. Authentication not configured?

It seems like the SAML authentication is failing. I am following this guide: http://blogs.splunk.com/2013/10/09/splunk-sso-using-saml-through-okta/

Splunk is configured to authenticate with LDAP, and is authenticating correctly. Does apache also need to be configured with ldap authentication to identify valid-users too? (not sure about how users are authenticated in apache/mellon, assumed that's all handled by the payload from IdP and mellon just knows about the identity

  • Can you post (anonymized) the dump of the mellon saml response? – 473183469 Nov 30 '15 at 14:52
  • Not sure how to get the dump. I have MellonPostDirectory "/var/cache/apache2/mod_auth_mellon/" and both MellonSamlResponseDump and MellonPostReplay set to On but not finding anything in that directory. – Brett Dec 1 '15 at 11:18
  • "If MellonSessionDump is set, then the SAML session will be available in the MELLON_SESSION environment variable". So it looks you need to setup a service html page to dump data. – 473183469 Dec 1 '15 at 11:33
2

It looks like a number of things were wrong. Firstly, I didn't realize that the metadata needed to be recopied from my IdP back to the apache configs when I modified the SAML settings that side. Anyway, after making sure the IdP and SP xml files were configured correctly in Apache, I was able to move on (I think I had changed the entity ID)

I was still getting an error around requiring a valid user in the error logs. It turns out that MellonEnable "auth" takes care of ensuring there's a valid user, while for some reason, Require valid-user and AuthType "Mellon" parameters were triggering errors and 500 server responses.

After removing these 2 directives, I was still getting errors, this time Could not find metadata for the IdP "(null)" - after a quick search, it turns out that latest version of lasso available on Ubuntu 14.04 LTS (2.4.0) does not work with the SHA256 signatures that the IdP was defaulting to. Lasso 2.5 support SHA256. After updating the IdP config with a compatible algorithm, identification was taking place correctly.

However, I was then faced with redirect loops because of the context. I found another post that suggested moving the web root of splunk to a /splunk context instead of at root (/), and by updating this, I am now able to authenticate to Splunk via mellon from the IdP. Here's the relevant working configs:

MellonLockFile "/var/lock/mod_auth_mellon.lock"
MellonPostDirectory "/var/cache/apache2/mod_auth_mellon/"

ProxyRequests Off
ProxyPassInterpolateEnv On
# Move the proxy directives out of <location> and specify the context / mapping
ProxyPass /splunk http://127.0.0.1:8000/splunk
ProxyPassReverse /splunk http://127.0.0.1:8000/splunk

<Location />
        MellonEnable "info"
        MellonVariable "cookie"
        MellonSamlResponseDump On
        MellonSPPrivateKeyFile /etc/apache2/mellon/urn_splunkweb.key
        MellonSPCertFile /etc/apache2/mellon/urn_splunkweb.cert
        MellonSPMetadataFile /etc/apache2/mellon/urn_splunkweb.xml
        MellonIdpMetadataFile /etc/apache2/mellon/idp-metadata.xml
        MellonEndpointPath /secret/endpoint
        MellonUser "NAME_ID"
        MellonDefaultLoginPath /splunk/en-US/
        RequestHeader set SplunkWebUser %{MELLON_NAME_ID}e
        ProxyPassInterpolateEnv On
</Location>
<Location /splunk/>
        # Forces /splunk requests to be authenticated via the IdP.
        MellonEnable "auth"
</Location>

$SPLUNK_HOME/etc/system/local/web.conf:

[settings]
trustedIP=127.0.0.1
remoteUser SplunkWebUser
SSOMode=permissive
root_endpoint = /splunk

And $SPLUNK_HOME/etc/system/local/server.conf

[general]
trustedIP=127.0.0.1

This is obviously for a setup where the apache/mellon server runs on the same host as splunk. web.conf (splunk) and auth_mellon.conf (apache) need to be updated with remote IPs if not. web.conf supports a comma-separated list of trusted hosts, while server.conf doesn't and should stay as localhost.

1

Stage a debug web page with the following:

<?php
header('Content-Type: text/plain');

foreach($_SERVER as $key=>$value) {
  if(substr($key, 0, 7) == 'MELLON_') {
    echo($key . '=' . $value . "\r\n");
  }
}
?>

Can you check whether the users'id is in the

  MellonUser "NAME_ID"

NAME_ID attribute? It looks suspicious to me. Usually it is uid or similar. In test phase you could change to any attribute you know IdP releases (mail, cn... whatever) just to avoid the 500 issue.

  • It looks like it's something to do with the setup of the location. If I set up the example from the mod mellon wiki, I am able to authenticate. I had a number of things wrong initially, specifically different namespaces in the IdP to mellon / sp setup (needed to re-download the metadata after making changes in the IdP). MELLON_NAME_ID is the correct field that I am looking for. Also not sure if there is an issue in the mod proxy / proxypass configuration, but now that I have the sample authenticating as expected I am going to work through the real service setup. – Brett Dec 1 '15 at 12:29
  • Thanks for the suggestion on the debug page @473183469, helped figure out the issues and come to a working solution, posted below. – Brett Dec 1 '15 at 13:53
  • NAME_ID is correct, that is what the IdP passes back. – Brett Dec 1 '15 at 13:58
0

Most probably IDP is not correctly configured with the LDAP & there is no extra configuration need for Mellon/Apache.

If you can post the dump of SAML response that will help to further drilldown the issue.

Please let me know if you want to discuss further.

Thanks, Sandy E- Sandy@mirketa.com

  • IdP was working correctly, was SP configuration in apache / mellon. – Brett Dec 1 '15 at 13:59

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.