Configure single sign-on with SAML

You can configure the Splunk platform to use the Security Assertion Markup Language (SAML) as an authentication scheme for single sign-on (SSO), using information that your SAML identity provider (IdP) supplies.

The Splunk platform supports many different types of identity provider for logins that use SAML for authentication. You can configure the platform with settings that are specific to your IdP.

You can also configure certificates and encryption for Splunk Enterprise so that communication between Splunk Enterprise and the IdP is secure. Splunk Enterprise supports the decryption of assertions that it receives from the IdP when you configure the IdP to encrypt those assertions.

Prerequisites for configuring SAML as an authentication scheme for single sign-on

Before you can configure SAML as an authentication scheme for single sign-on, you must have the following:

• A running Splunk platform instance
  • The instance must have access to a SAML IdP that Splunk supports
  • You must have administrator access to this instance to configure the SAML authentication scheme for SSO
  • The user you use to log into the platform must hold a role with the change_authentication capability
  • The Splunk platform instance must be able to contact the IdP over the network
• An IdP that is compliant with version 2 of the SAML protocol
  • The IdP must be able to provide the role, realName, and mail attributes in an assertion that it sends to the Splunk platform
  • There is native support for IdPs that have support for Attribute Query Requests (AQR)
  • There is support through authentication extensions for some IdPs that do not have support for AQR
  • Supported IdPs include but are not limited to PingIdentity, Okta, Microsoft Azure, Active Directory Federation Services, OneLogin, Optimal, and CA Siteminder

Additional requirements for configuring SAML as an authentication scheme for single sign-on in Splunk Cloud

• Splunk Cloud supports only IdPs that send a Secure Hash Algorithm 256-bit (SHA-256) signature in SAML messages. You are responsible for the SAML configuration of your IdP including the use of SHA-256 signatures.

Caveats for using SAML as an authentication scheme for single sign-on

If you plan to connect your Splunk platform instance to a SAML IdP for authentication, note the following caveats which might present problems for your specific application:

• With the exception of the Microsoft Azure and Okta IdPs, the SAML authentication scheme does not automatically keep users in sync with the IdP. Specifically, the scheme provisions and authenticates users with information from the IdP during login, but does not automatically remove users who no longer exist on the IdP.
  • To configure the Splunk platform to delete users on Microsoft Azure, see Configure SSO with Microsoft Azure AD or AD FS.
  • To configure the Splunk platform to delete users on Okta, see Configure SSO with Okta as your identity provider.
• The Splunk platform always outputs usernames in lowercase when it communicates with an IdP over SAML. If your IdP requires case preservation with usernames, you can change the username to lowercase at the IdP or configure the IdP to accept the lowercase version of a username.
• When you configure a search head to use SAML as an authentication scheme and then later restart the search head, then you must re-enter your SAML credentials to access saved searches after the restart.

Configure the Splunk platform to authenticate into your IdP using SAML

The following instructions are high level, and presume that you have access to Splunk Web. If you prefer, and only if you use Splunk Enterprise, you can configure SAML SSO using configuration files. See Configure SAML SSO using configuration files.

You might need to perform additional configuration for your IdP, or use the procedures for a specific IdP instead. If you are unsure as to what values are appropriate for your IdP, file a support case if you have an entitlement with Splunk, or ask a question on Splunk Answers if you do not.

Configure single sign-on using SAML as an authentication scheme

Following is the basic procedure for configuring SAML as an authentication scheme for the Splunk platform.

1. Log into the Splunk platform as an administrator level user.
2. From the system bar, click Settings > Authentication Methods.
3. Under External, click SAML. A link Configure Splunk to use SAML appears.
4. Click Configure Splunk to use SAML. The SAML configuration dialog box appears.
5. In the General Settings section of the "SAML configuration" dialog box, supply the appropriate information to access your IdP. You must supply at least the following values in the "General Settings" section:
   1. Single Sign-on (SSO) URL: The URL that the IdP uses to process the SAML login for single sign-on.
   2. IdP Certificate Chains: Text that represents one or more IdP certificates chained together. Certificate chains must be in order, starting with the root certificate, any intermediate certificates, and finally leaf certificates. You can paste the entire certificate chain into the field. Also, the chain can be comprised of a single certificate.
   3. Issuer ID: The unique identifier for the IdP. Typically in the form of a URL.
   4. Entity ID: An identifier for this instance thst is unique across all entities on the IdP. Typically in the form of a URL.
6. (Optional) In the Alias section, supply the three aliases as provided by your IdP, if your IdP provides those aliases:
   1. Role alias
   2. RealName alias
   3. Mail alias

Configure single-sign-on using SAML as an authentication scheme for specific IdPs

Splunk has written instructions on how to configure single-sign on with SAML on various identity providers. These instructions are helpful for customers who use these IdPs, but this list does not represent the full set of IdPs that Splunk supports for authentication using SAML. The Splunk platform can authenticate using any IdP that is compliant with SAML version 2.0.

1. See the following links for instructions on how to configure the Splunk platform to use SAML authentication for a specific IdP:
   • Ping Identity
   • Okta
   • Azure AD or AD FS
   • OneLogin
   • Optimal
   • CA siteminder
2. Map SAML groups to Splunk roles. See Map SAML groups to Splunk Enterprise roles for instructions.

Configure automatic decryption of SAML assertions from an IdP

If you want to ensure secure communication between your IdP and your Splunk Enterprise instance, you can enable encrypted SAML assertions. When the Splunk platform receives an encrypted assertion from an IdP, it automatically decrypts the assertion and processes the login based on the information in the assertion, provided that you supply a public key to the IdP and enable encrypted assertions on the IdP.

You can configure automatic decryption of SAML assertions using the default server certificate only. Currently, there is no support for this option with other certificates.

1. Open a shell or command prompt.
2. On your Splunk platform instance, change to the $SPLUNK_HOME/etc/auth directory.
3. Export the public key from the default server certificate using the openssl command:

   $SPLUNK_HOME/bin/splunk cmd openssl x509 -outform der -in server.pem -out publicKey.crt
   

4. Using the configuration interface of your IdP, enable encrypted assertions on your IdP.

   This setup differs based on the IdP you use. Some IdPs might not support encrypted assertions.

5. Using the configuration interface of your IdP, upload the publicKey.crt file to your IdP
6. Follow the instructions earlier in this topic to configure the Splunk platform to authenticate using your IdP.
7. Log into the Splunk platform with a user that already exists on your IdP. If login succeeds, you have configured SAML assertion correctly.