Splunk SAML SSO from an IdP with Apache mod_mellon fails

Question

I am trying to configure SSO from an IdP to Apache with mod_mellon and mod proxy to splunk.

Environment: Ubuntu 14.04; Apache 2.4.7; mod-auth-mellon 0.7.0.

Apache configured with the mellon-generated key / cert on default ssl site. mod proxy is being used to proxy to splunk locally on port 8000.

auth_mellon.conf:

MellonCacheSize 100
MellonLockFile "/var/lock/mod_auth_mellon.lock"
MellonPostDirectory "/var/cache/apache2/mod_auth_mellon/"

ProxyRequests Off
ProxyPass /secret/ !
ProxyPassInterpolateEnv On
<Location />
        MellonEnable "info"
        Require valid-user
        AuthType "Mellon"
        MellonVariable "cookie"
        MellonSamlResponseDump On
        MellonSPPrivateKeyFile /etc/apache2/mellon/urn_splunk.key
        MellonSPCertFile /etc/apache2/mellon/urn_splunk.cert
        MellonSPMetadataFile /etc/apache2/mellon/urn_splunk.xml
        MellonIdpMetadataFile /etc/apache2/mellon/idp-meta.xml
        MellonEndpointPath /secret/endpoint
        MellonUser "NAME_ID"
        MellonDefaultLoginPath /en-US/
        RequestHeader set SplunkWebUser %{MELLON_NAME_ID}e
        MellonSamlResponseDump On

        ProxyPass http://127.0.0.1:8000/
        ProxyPassReverse http://127.0.0.1:8000/
        ProxyPassInterpolateEnv On
</Location>

idp-meta.xml contains the metadata from the IDP (including the IDP x509 cert and HTTP Post / HTTP Redirect parameters). the urn_service.* files are generated from a mellon_create_metadata.sh script that creates an x509 cert and key on the SP and xml config file.

When I try access the splunk from the IdP, I see errors in the apache log file, and get a 500 / internal server error response:

[authz_core:debug] mod_authz_core.c(802): AH01626: authorization result of Require valid-user : denied (no authenticated user yet)
[authz_core:debug] mod_authz_core.c(802): AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[core:error] AH00027: No authentication done but request not allowed without authentication for /secret/endpoint/login. Authentication not configured?

It seems like the SAML authentication is failing. I am following this guide: http://blogs.splunk.com/2013/10/09/splunk-sso-using-saml-through-okta/

Splunk is configured to authenticate with LDAP, and is authenticating correctly. Does apache also need to be configured with ldap authentication to identify valid-users too? (not sure about how users are authenticated in apache/mellon, assumed that's all handled by the payload from IdP and mellon just knows about the identity

Answer 1

It looks like a number of things were wrong. Firstly, I didn't realize that the metadata needed to be recopied from my IdP back to the apache configs when I modified the SAML settings that side. Anyway, after making sure the IdP and SP xml files were configured correctly in Apache, I was able to move on (I think I had changed the entity ID)

I was still getting an error around requiring a valid user in the error logs. It turns out that MellonEnable "auth" takes care of ensuring there's a valid user, while for some reason, Require valid-user and AuthType "Mellon" parameters were triggering errors and 500 server responses.

After removing these 2 directives, I was still getting errors, this time Could not find metadata for the IdP "(null)" - after a quick search, it turns out that latest version of lasso available on Ubuntu 14.04 LTS (2.4.0) does not work with the SHA256 signatures that the IdP was defaulting to. Lasso 2.5 support SHA256. After updating the IdP config with a compatible algorithm, identification was taking place correctly.

However, I was then faced with redirect loops because of the context. I found another post that suggested moving the web root of splunk to a /splunk context instead of at root (/), and by updating this, I am now able to authenticate to Splunk via mellon from the IdP. Here's the relevant working configs:

MellonLockFile "/var/lock/mod_auth_mellon.lock"
MellonPostDirectory "/var/cache/apache2/mod_auth_mellon/"

ProxyRequests Off
ProxyPassInterpolateEnv On
# Move the proxy directives out of <location> and specify the context / mapping
ProxyPass /splunk http://127.0.0.1:8000/splunk
ProxyPassReverse /splunk http://127.0.0.1:8000/splunk

<Location />
        MellonEnable "info"
        MellonVariable "cookie"
        MellonSamlResponseDump On
        MellonSPPrivateKeyFile /etc/apache2/mellon/urn_splunkweb.key
        MellonSPCertFile /etc/apache2/mellon/urn_splunkweb.cert
        MellonSPMetadataFile /etc/apache2/mellon/urn_splunkweb.xml
        MellonIdpMetadataFile /etc/apache2/mellon/idp-metadata.xml
        MellonEndpointPath /secret/endpoint
        MellonUser "NAME_ID"
        MellonDefaultLoginPath /splunk/en-US/
        RequestHeader set SplunkWebUser %{MELLON_NAME_ID}e
        ProxyPassInterpolateEnv On
</Location>
<Location /splunk/>
        # Forces /splunk requests to be authenticated via the IdP.
        MellonEnable "auth"
</Location>

$SPLUNK_HOME/etc/system/local/web.conf:

[settings]
trustedIP=127.0.0.1
remoteUser SplunkWebUser
SSOMode=permissive
root_endpoint = /splunk

And $SPLUNK_HOME/etc/system/local/server.conf

[general]
trustedIP=127.0.0.1

This is obviously for a setup where the apache/mellon server runs on the same host as splunk. web.conf (splunk) and auth_mellon.conf (apache) need to be updated with remote IPs if not. web.conf supports a comma-separated list of trusted hosts, while server.conf doesn't and should stay as localhost.

Answer 2

Stage a debug web page with the following:

<?php
header('Content-Type: text/plain');

foreach($_SERVER as $key=>$value) {
  if(substr($key, 0, 7) == 'MELLON_') {
    echo($key . '=' . $value . "\r\n");
  }
}
?>

Can you check whether the users'id is in the

  MellonUser "NAME_ID"

NAME_ID attribute? It looks suspicious to me. Usually it is uid or similar. In test phase you could change to any attribute you know IdP releases (mail, cn... whatever) just to avoid the 500 issue.

Answer 3

Most probably IDP is not correctly configured with the LDAP & there is no extra configuration need for Mellon/Apache.

If you can post the dump of SAML response that will help to further drilldown the issue.

Please let me know if you want to discuss further.

Thanks, Sandy E- Sandy@mirketa.com