This tutorial is based on SAML SSO with Auth0 as Service Provider and as an Identity Provider, but the steps that are relevant to configuring an Auth0 tenant as the Service Provider (SP) are replaced with Splunk Configuration.

In this section you will configure one Auth0 tenant (tenant 2) to serve as an Identity Provider. You will do this by registering an application, but in this case, the ‘application’ you register is really a representation of tenant 1, the SAML Service Provider.

In the Auth0 dashboard:

1. Click on “Applications” link at left.
2. Click on the red “+ CREATE APPLICATION” button on the right.

3. In the Name field, enter a name (I’ve had mine as “Splunk 7.0.3 Container”).
4. Press the blue “SAVE” button.
5. Click on the “Settings” tab.
6. Scroll down and click on the “Show Advanced Settings” link.
7. In the expanded window, scroll down to the “Certificates” section and click on the “DOWNLOAD CERTIFICATE” link and select PEM from the dropdown, to download a PEM-formatted certificate. The certificate will be downloaded to a file called “YOUR_TENANT.pem”. Save this file as you will need to upload this file when configuring the other Auth0 tenant, tenant 1.

8. Click on the “Endpoints” tab and go to the “SAML” section.. Follow the “SAML Metadata URL” to download the IdP metadata file which we will need later in Splunk SAML configuration.
9. Click on the “Endpoints” tab and go to the “SAML” section. Copy the entire contents of the “SAML Protocol URL” field and save it as in the next step you will need to paste it into Splunk SSO configuration .

Creating User(s) in Auth0

Next, create a user to use in testing the SAML SSO sequence. In the Auth0 dashboard:

1. On the lefthand side, navigate to Users and Roles > Users
2. Click on the “+ CREATE YOUR FIRST USER” button.

3. In the Email field, enter an email for your test user. The domain name for the email should match what you enter in section 3 below. For example, if your user is john.doe@abc-example.com, you would enter that here, and then enter “abc-example.com” in step 3 below for the Email domain.
4. Enter a password for the user
5. For the Connection, leave it at the default value. (Username-Password-Authentication)
6. Press the blue “SAVE” button.

Creating Roles and assigning user(s) in Auth0

Since Splunk relies on the IdP to return the user roles you will need to create at least one  new Role and assign a user to it.

1. On the lefthand side, navigate to Users and Roles > Roles
2. Click on the “+ CREATE ROLE” button.

3. Once the Role is created click on “ADD USERS” button

4. From the dropdown list select the user and click “ASSIGN“

NOTE: for Auth0 to return the groups information in SAML you will need to follow the steps in Return User Roles in Auth0.

Configure Splunk

1. Login to Splunk
2. Navigate to “Settings” > “Access Controls” > “Authentication Method”
3. Under External authentication methods, select “SAML” and click the “SAML Settings” link

4. Create the required SAML groups (and assign roles to them), so that these group names will be matched with the Auth0 role names

5. On top right corner click the “SAML Configuration” button
6. On the right of the “Metadata XML File” click “Select File” and upload the IdP metadata file that you’ve downloaded from Auth, it will be called something like dev-1a2b3c4d-idp_au_auth0_com-metadata.xml (the first part will depend on your Auth0 tenant name).

7. This will populate most the required fields in the SAML settings.

8. Now fill in “Entity ID”, must be unique for your IdP (I used “Splunk703”)
9. I have also used “Aliases” to get the Roles information from Auth0

10. 10. At the top of this SAML Configuration page click the “Download” button to get Splunk’s SP Metadata File

     

    Add your Service Provider (Splunk) metadata to the Identity Provider (Auth0)

    In this section you will go back and add some information about the Service Provider (Splunk) to the Identity Provider (Auth0) so the Identity Provider Auth0 tenant knows how to receive and respond to SAML-based authentication requests from the Splunk.
    In the Auth0 dashboard:

    1. Click on “Applications” link at left.
    2. Find the row for the application you created earlier, and click on the “Add Ons” icon to the right of the application name. (the angle bracket and slash icon)
    3. Locate the box with the “SAML2 WEB APP” label and click on the circle toggle to turn it green.

    

    4. Next, a configuration window will pop up for the “Addon: SAML2 Web App”. Make sure you are in the Settings” tab.

    

    5. In the “Application Callback URL” field, paste in the Assertion Consumer Service URL that can be found in the Splunk SP Metadata XML file that you’ve downloaded from Splunk UI in the previous section. It will be the value of
       SPSSODescriptor > AssertionConsumerService > Location (http://splunk703_01:8000/saml/acs in my case)
    6. 

    

    6. In the Settings field below, go to line 2 that has the “audience” attribute.

    First remove the “//” at the beginning of the line to uncomment it, and remove the comma (‘,’) from the end of the line.
    Next, replace the original value (urn:foo) with the Entity ID value you used in Splunk. The new line 2 should look something like:
    

     

     
    7. Click on the blue “SAVE” button at the bottom of the screen

     

    Test Identity Provider

    In the same screen, click on the red “DEBUG” button.
    That will trigger a login screen from tenant 2, the Identity Provider.
    Log in with the credentials for the user you created above.
    
    If your configuration is correct, you will see a screen titled “It works!”
    This screen will show you the encoded and decoded SAML response that would be sent by the Identity Provider.
    Check the decoded SAML response and locate (about half-way down) the "<saml:Audience>" tag and make sure it matches the Entity ID you entered in the previous screen (obtained during step 3).
    Click on “Close this window” at the bottom of the screen.

    Logging In

    Browse to you Splunk URL (http://splunk703_01:8000/en-US/) in my case.
    You will be redirected to the Auth) Authentication screen
    
    After you provide your credentials your browser will redirect back into Splunk
    You can verify that the user has received the expected roles by logging in as Admin and going to Settings > Access Controls > Users
    
    By the way,, if you want to bypass SAML and login using Splunk local user browse to<SPLUNK_URL>/account/login?loginType=Splunk (which is http://splunk703_01:8000/en-US/account/login?loginType=Splunk in my case)

Related posts about Splunk

The post Configure Splunk SSO with Auth0 as your identity provider appeared first on ISbyR.

This tutorial is based on SAML SSO with Auth0 as Service Provider and as an Identity Provider, but the steps that are relevant to configuring an Auth0 tenant as the Service Provider (SP) are replaced with Splunk Configuration.

In this section you will configure one Auth0 tenant (tenant 2) to serve as an Identity Provider. You will do this by registering an application, but in this case, the ‘application’ you register is really a representation of tenant 1, the SAML Service Provider.

In the Auth0 dashboard:

1. Click on “Applications” link at left.
2. Click on the red “+ CREATE APPLICATION” button on the right.

3. In the Name field, enter a name (I’ve had mine as “Splunk 7.0.3 Container”).
4. Press the blue “SAVE” button.
5. Click on the “Settings” tab.
6. Scroll down and click on the “Show Advanced Settings” link.
7. In the expanded window, scroll down to the “Certificates” section and click on the “DOWNLOAD CERTIFICATE” link and select PEM from the dropdown, to download a PEM-formatted certificate. The certificate will be downloaded to a file called “YOUR_TENANT.pem”. Save this file as you will need to upload this file when configuring the other Auth0 tenant, tenant 1.

8. Click on the “Endpoints” tab and go to the “SAML” section.. Follow the “SAML Metadata URL” to download the IdP metadata file which we will need later in Splunk SAML configuration.
9. Click on the “Endpoints” tab and go to the “SAML” section. Copy the entire contents of the “SAML Protocol URL” field and save it as in the next step you will need to paste it into Splunk SSO configuration .

Creating User(s) in Auth0

Next, create a user to use in testing the SAML SSO sequence. In the Auth0 dashboard:

1. On the lefthand side, navigate to Users and Roles > Users
2. Click on the “+ CREATE YOUR FIRST USER” button.

3. In the Email field, enter an email for your test user. The domain name for the email should match what you enter in section 3 below. For example, if your user is john.doe@abc-example.com, you would enter that here, and then enter “abc-example.com” in step 3 below for the Email domain.
4. Enter a password for the user
5. For the Connection, leave it at the default value. (Username-Password-Authentication)
6. Press the blue “SAVE” button.

Creating Roles and assigning user(s) in Auth0

Since Splunk relies on the IdP to return the user roles you will need to create at least one  new Role and assign a user to it.

1. On the lefthand side, navigate to Users and Roles > Roles
2. Click on the “+ CREATE ROLE” button.

3. Once the Role is created click on “ADD USERS” button

4. From the dropdown list select the user and click “ASSIGN“

NOTE: for Auth0 to return the groups information in SAML you will need to follow the steps in Return User Roles in Auth0.

Configure Splunk

1. Login to Splunk
2. Navigate to “Settings” > “Access Controls” > “Authentication Method”
3. Under External authentication methods, select “SAML” and click the “SAML Settings” link

4. Create the required SAML groups (and assign roles to them), so that these group names will be matched with the Auth0 role names

5. On top right corner click the “SAML Configuration” button
6. On the right of the “Metadata XML File” click “Select File” and upload the IdP metadata file that you’ve downloaded from Auth, it will be called something like dev-1a2b3c4d-idp_au_auth0_com-metadata.xml (the first part will depend on your Auth0 tenant name).

7. This will populate most the required fields in the SAML settings.

8. Now fill in “Entity ID”, must be unique for your IdP (I used “Splunk703”)
9. I have also used “Aliases” to get the Roles information from Auth0

10. 10. At the top of this SAML Configuration page click the “Download” button to get Splunk’s SP Metadata File

     

    Add your Service Provider (Splunk) metadata to the Identity Provider (Auth0)

    In this section you will go back and add some information about the Service Provider (Splunk) to the Identity Provider (Auth0) so the Identity Provider Auth0 tenant knows how to receive and respond to SAML-based authentication requests from the Splunk.
    In the Auth0 dashboard:

    1. Click on “Applications” link at left.
    2. Find the row for the application you created earlier, and click on the “Add Ons” icon to the right of the application name. (the angle bracket and slash icon)
    3. Locate the box with the “SAML2 WEB APP” label and click on the circle toggle to turn it green.

    

    4. Next, a configuration window will pop up for the “Addon: SAML2 Web App”. Make sure you are in the Settings” tab.

    

    5. In the “Application Callback URL” field, paste in the Assertion Consumer Service URL that can be found in the Splunk SP Metadata XML file that you’ve downloaded from Splunk UI in the previous section. It will be the value of
       SPSSODescriptor > AssertionConsumerService > Location (http://splunk703_01:8000/saml/acs in my case)
    6. 

    

    6. In the Settings field below, go to line 2 that has the “audience” attribute.

    First remove the “//” at the beginning of the line to uncomment it, and remove the comma (‘,’) from the end of the line.
    Next, replace the original value (urn:foo) with the Entity ID value you used in Splunk. The new line 2 should look something like:
    

     

     
    7. Click on the blue “SAVE” button at the bottom of the screen

     

    Test Identity Provider

    In the same screen, click on the red “DEBUG” button.
    That will trigger a login screen from tenant 2, the Identity Provider.
    Log in with the credentials for the user you created above.
    
    If your configuration is correct, you will see a screen titled “It works!”
    This screen will show you the encoded and decoded SAML response that would be sent by the Identity Provider.
    Check the decoded SAML response and locate (about half-way down) the "<saml:Audience>" tag and make sure it matches the Entity ID you entered in the previous screen (obtained during step 3).
    Click on “Close this window” at the bottom of the screen.

    Logging In

    Browse to you Splunk URL (http://splunk703_01:8000/en-US/) in my case.
    You will be redirected to the Auth) Authentication screen
    
    After you provide your credentials your browser will redirect back into Splunk
    You can verify that the user has received the expected roles by logging in as Admin and going to Settings > Access Controls > Users
    
    By the way,, if you want to bypass SAML and login using Splunk local user browse to<SPLUNK_URL>/account/login?loginType=Splunk (which is http://splunk703_01:8000/en-US/account/login?loginType=Splunk in my case)

Related posts about Splunk

The post Configure Splunk SSO with Auth0 as your identity provider appeared first on ISbyR.

Sometimes you would want to copy PuTTY hosts SSH keys between different users or machines. Having the keys stored will prevent the pop-up message in PuTTY (or Plink/PSCP) when you try to connect to the remote host for the first time.

Some of the cases you would want to do that is:

• Solution was developed and tested on one machine but will need to run on an other
• You want to carry you host keys from one machine to another

This article is about copying PuTTY SSH hosts keys focused on doing so on Windows machines.

Method

The Putty SSH hosts keys are saved in registry in

[HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys]

for the current user.
So if you are copying keys for the current user you are logged in with (but between different machines) its easy. Just export the relevant registry path and import it on the destination machine.

The problem raises when you want to copy keys to profile of a user other then the user you are currently logged in with.

Identify your destination in registry

• Open command line (on the target server) and run
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist | findstr TARGETUSER
• For example I want to copy my keys to user ilya_adm

C:\REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist | findstr ilya_adm
    \Registry\User\S-1-5-21-1229272821-1123561945-839522115-123456    REG_SZ    \Device\HarddiskVolume1\Users\ilya_adm\NTUSER.DAT
    \Registry\User\S-1-5-21-1229272821-1123561945-839522115-123456_Classes    REG_SZ    \Device\HarddiskVolume1\Users\ilya_adm\AppData\Local\Microsoft\Windows\UsrClass.dat

• Note the GUID S-1-5-21-1229272821-1123561945-839522115-123456
• Due to the above the destination location in registry will be [HKEY_USERS\S-1-5-21-1229272821-1123561945-839522115-123456\Software\SimonTatham\PuTTY\SshHostKeys]

Manually update the registry

You can manually duplicate a single host key entry by creating a new STRING value in the destination registry location ( [HKU\S-1-5-21-….-123456\Software\SimonTatham\PuTTY\SshHostKeys]) and copy the Name and Value from the source location (HKCU\Software\SimonTatham\PuTTY\SshHostKeys)

Export/Import PuTTY SSH Hosts keys

Perform with caution and preferably back up the destination registry location

• Export the they host keys from source location to a file.

From command line run

REG EXPORT HKCU\Software\SimonTatham\PuTTY\SshHostKeys c:\temp\source.reg

• Open the c:\temp\source.reg file

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys]
"rsa2@22:123.xx.1237"="0x10001,0xaeda610d2dea35d252c8410cb6c7
"rsa2@22:123.xx.12319"="0x10001,0xd9f47896e1aaebb85d801ac5d75
"rsa2@22:123.xx.1238"="0x10001,0xf3ce0d57f72f09b4f48d23c763fe
"rsa2@22:123.xx.123213"="0x10001,0xd9f47896e1aaebb85d801ac5d7

• In the file the change the location to be the destination. for example

update
[HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys]
to be
[HKEY_USERS\S-1-5-21-1229272821-1123561945-839522115-123456\Software\SimonTatham\PuTTY\SshHostKeys]

Windows Registry Editor Version 5.00
[HKEY_USERS\S-1-5-21-1229272821-1123561945-839522115-123456\Software\SimonTatham\PuTTY\SshHostKeys]
"rsa2@22:123.xx.1237"="0x10001,0xaeda610d2dea35d252c8410cb6c7
"rsa2@22:123.xx.12319"="0x10001,0xd9f47896e1aaebb85d801ac5d75
"rsa2@22:123.xx.1238"="0x10001,0xf3ce0d57f72f09b4f48d23c763fe
"rsa2@22:123.xx.123213"="0x10001,0xd9f47896e1aaebb85d801ac5d7

• Save the file and import

From command line run

    REG IMPORT c:\temp\source.reg

Done

That’s it. Now you have the all the PuTTY SSH hosts keys from the source (user/machine) registry in the  destination (user/machine) registry.

Image by Brenda Clarke

The post How to copy PuTTY SSH Hosts Keys between different users/machines on Windows appeared first on ISbyR.

I was recently introduced to Slack by a friend of mine and found it to be quite awesome (especially if the organization that you are working in doesn’t block their site). It allows you to have all of the communication in the organization to be in one place. So I thought: “If that’s the place where all the communication goes, SiteScope should send it’s alerts there as well”. That’s how this SiteScope to Slack Alerts Integration idea was born.

The Integration is based on slack-webhook by gpedro. At the current version this Slack to SiteScope Alerts Integration is pretty basic: It uses standard SiteScope script alerts parameters to get the name of the monitor and its status, as well as the location of alerts file that is been created and drops the content as the Slack message attachment.

Enough theory let’s get to work!

Configuration

Slack Configuration

• Go to https://your_team.slack.com/services/new
• Search for Incoming WebHook and click on Add
• Choose Channel to Post and press Add Incoming WebHooks Integration
• In the Setup Instructions section, you will find a WebHook URL.Copy the part after .…services/ (for example if your URL is  https://hooks.slack.com/services/A1A1A1A1A/B2B2B2B2B/c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3 then copy aside the A1A1A1A1A/B2B2B2B2B/c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3 part)

SiteScope Configuration

• Download the SisToSlackAlert.zip file
• Here is what the zip file contains:

└───SisToSlackAlert
    │   SisToSlackAlert.bat
    │   
    ├───conf
    │       log4j.properties
    │       slack.properties
    │       
    ├───lib
    │       gson-2.3.1.jar
    │       log4j.jar
    │       PropUtils.jar
    │       SisToSlackAlert.jar
    │       
    └───logs
            SisToSlackAlert.bat.err.log
            SisToSlackAlert.bat.log

•  You might have a warning about the zip file being dangerous, still proceed

SisToSlackAlert Zip file Browser Warning

• Extract its content under <SiteScope_Dir>\_custom folder (from now on it will be referenced as <SisToSlackAlert_Dir>)

• Copy the  <SisToSlackAlert_Dir>\SisToSlackAlert.bat  to  <SiteScope_Dir>\scripts folder

SiteScope to Slack Alerts Integration Configuration

Update the <SiteScope_Dir>\scripta\SisToSlackAlert.bat file with your properties of your SiteScope deployment

Update the  <SisToSlackAlert_Dir>\conf\slack.properties  configuration file with your details:

If you you’ve extracted the SisToSlackAlert.zip to a location other than <SiteScope_Dir>\_custom update the  <SisToSlackAlert_Dir>\conf\log4j.properties (the value you configure should be relative to the <SiteScope_Dir> folder).

SiteScope Alerts Configuration

Now, the only thing that needs to be done is:

• Create the alerts in SiteScope, the same regular way you are used to do it

• Add a new Script action. In the Script Action – select the SisToSlackAlert.bat script and as the first parameter pass the Status (Error/Warning/Normal)

By the way, if you already have an Alert set-up just add the required SisToSlackAlert actions

Results and Troubleshooting

So after you’ve finished your configuration you want to see some results!

The following SiteScope monitor

Should produce a Slack message similar to that one (the content of it depends on your script’s template)

If for some reason you don’t get the messages in Slack or the message seems different from what you expect try to look into the following logs:

• <SisToSlackAlert_Dir>\logs\SisToSlackAlert.bat.log – Logs parameters that the Java code was called with, Refreshed each time the Alert’s action is triggered.
• <SisToSlackAlert_Dir>\logs\SisToSlackAlert.bat.err.log – Logs Errors that occurred during the execution of the Java code was called with, Refreshed each time the Alert’s action is triggered
• <SisToSlackAlert_Dir>\logs\SisToSlackAlert.log – You will mostly find here logs related to the way that SiteScope data is converted to the Slack message and the message is designed. Logging severity can be changed in the <SisToSlackAlert_Dir>\conf\log4j.properties. That’s a daily log

P.S.

I have a few thoughts about making this Slack to SiteScope Alerts Integration more robust and will be happy to hear your ideas about that. and any other thoughts you might have about the current version.

The post SiteScope to Slack Alerts Integration appeared first on ISbyR.