Duo Two-Factor Authentication for Splunk Enterprise

Overview

Before starting to add two-factor authentication to Splunk Enterprise, make sure that Duo is compatible with your Splunk install. Log into Splunk's web interface and click the about link in the top right corner.

Splunk Enterprise on-premises solutions include Duo Security MFA. Duo Universal Prompt requires Splunk Enterprise on-premises versions 9.1.6, 9.1.7, 9.2.3, 9.3.1, or higher. Versions: 9.2.0, 9.2.1, 9.2.2, and 9.3.0 show the traditional Duo Prompt in an iframe and may experience authentication issues in the future.

Splunk Cloud does not support Duo MFA. Try securing Splunk Cloud logins with Duo Single Sign-On for Splunk Cloud.

First Steps

1. Sign up for a Duo account.
2. Log in to the Duo Admin Panel and navigate to Applications → Protect an Application.
3. Locate the entry for Splunk in the applications list. Click Protect to the far-right to configure the application. and get your Client ID, Client secret, and API hostname. You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications in Duo and additional application options.
   
   

   Previously, the Client ID was called the "Integration key" and the Client secret was called the "Secret key".

4. Use NTP to ensure that your server's time is correct.

Duo Universal Prompt

The Duo Universal Prompt provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.

Universal Prompt	Traditional Prompt

For Splunk applications created before March 2024, migration to Universal Prompt is a three-step process:

1. Install an update for the Splunk application, which implements a redirect to Duo during authentication to support the Universal Prompt.
2. Authenticate with Duo 2FA using the updated application so that Duo makes the Universal Prompt activation setting available in the Admin Panel. This first authentication after updating shows the traditional Duo prompt in a redirect instead of an iframe.
3. From the Duo Admin Panel, activate the Universal Prompt experience for users of that Duo Splunk application if the traditional prompt is still selected. Once activated, all users of the application see the Duo Universal Prompt in a redirect.

If you created your Splunk application before March 2024, it's a good idea to read the Universal Prompt Update Guide for more information, about the update process and the new login experience for users, before you activate the Universal Prompt for your application.

New Splunk Applications

When you install the latest version of Splunk you're ready to use the Universal Prompt. Splunk applications created after March 2024 have the Universal Prompt activated by default. If you're configuring Splunk now, proceed with the installation instructions in this document.

The "Universal Prompt" area of the application details page shows this application as "Activation complete", with these activation control options:

• Show traditional prompt: Your users experience Duo's traditional prompt via redirect when logging in to this application.
• Show new Universal Prompt: (Default) Your users experience the Universal Prompt via redirect when logging in to this application.

Existing Splunk Applications

Splunk needs a software update from Splunk installed to support the Universal Prompt. The "Universal Prompt" section reflects this status as "Update required" today. To update the Splunk Duo application to a newer version, follow the update directions below.

Once a user authenticates to Splunk via the updated Duo application, the "Universal Prompt" section of the Splunk application page reflects this status as "Ready to activate", with these activation control options:

• Show traditional prompt: (Default) Your users experience Duo's traditional prompt via redirect when logging in to this application.
• Show new Universal Prompt: Your users experience the Universal Prompt via redirect when logging in to this application.

In addition, the "Integration key" and "Secret key" property labels for the application update to "Client ID" and "Client secret" respectively. The values for these properties remain the same.

Activate Universal Prompt

Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications.

Enable the Universal Prompt experience by selecting Show new Universal Prompt if the traditional prompt is still selected, and then scrolling to the bottom of the page to click Save.

Once you activate the Universal Prompt, the application's Universal Prompt status shows "Activation complete" here and on the Universal Prompt Update Progress report.

Should you ever want to roll back to the traditional prompt, you can return to this setting and change it back to Show traditional prompt. However, this will still deliver the Duo prompt via redirect, not in an iframe. Keep in mind that support for the traditional Duo prompt ended for the majority of applications in March 2024.

Universal Update Progress

Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications. You can also activate the new prompt experience for multiple supported applications from the report page instead of visiting the individual details pages for each application.

Configure Duo for Splunk Enterprise

1. Log into Splunk Enterprise as an admin and navigate to Settings → **Authentication Method.

2. Under "Multifactor Authentication", select Duo Security and then click Configure Duo Security.

3. Fill out the form with your Duo Splunk application information:

   Integration Key	Your Client ID.
   Secret Key	Your Client secret
   API Hostname	Your API hostname (i.e. api-XXXXXXXX.duosecurity.com).
   Authentication behavior when Duo Security is unavailable	Choose Let users login to allow Splunk logins when Duo Security cloud services are unreachable, or Do not let users login to prevent access to Splunk without Duo authentication.
   Enable 2FA for REST endpoints	Enable this if you want to require Duo MFA against REST endpoints using a Splunk session key.
   Connection Timeout	The maximum limit, in seconds, to complete authentication.

4. Click the Save button when done. You can now test your setup

Learn more about Splunk's support for Duo MFA and the configuration options in the Splunk documentation.

Test Your Setup

To test your setup, log into Splunk Enterprise using the hostname or fully-qualified domain name URL. Successful verification of your username and password redirects you to Duo. Complete Duo two-factor authentication when prompted and then you'll return to Splunk to complete the login process.

Update Splunk Enterprise

You'll need to upgrade your Splunk Enterprise installation to version 9.1.6, 9.1.7, 9.2.3, 9.3.1, or higher to be able to use the Universal Prompt. Versions 9.3.0, 9.2.2, 9.2.1, 9.2.0, or any below 9.1.6 do not have Universal Prompt support.

Consult the How to Upgrade Splunk Enterprise documentation for more information about planning and executing your upgrade, and then use the Migrate from the Duo Traditional Prompt to the Duo Universal Prompt instructions to configure Duo Universal Prompt after your Splunk Enterprise upgrade.

After upgrading, authenticate once from Splunk, which will show the traditional Duo Prompt in a redirect instead of the iframe. After that you can activate Universal Prompt for your Splunk application.

Troubleshooting

Need some help? Take a look at our Splunk Knowledge Base articles or Community discussions. For further assistance, contact Support.