Securing Splunk Enterprise

Configure single sign-on with SAML

You can configure Splunk software to use SAML authentication for single sign-on (SSO), using information provided by your supported identity provider (IdP).

Caution: Before you attempt to configure SSO in Splunk Cloud, contact Splunk Support and open a ticket requesting them to prepare your cloud deployment for SSO. When they have configured your deployment, they will notify you and provide the certificate required.

Prerequisites

• Either:
  • A running version of Splunk software OR
  • A managed deployment of Splunk Cloud. Self-service deployments of Splunk Cloud log in through the Splunk customer portal and cannot independently configure SAML SSO.
• An identity provider configured to provide the role, realName, and mail attributes. The supported identity providers are:
  • Ping Identity
  • Okta
  • Azure AD
  • AD FS
• An admin role with the change_authentication capability. This permission level lets you enable SAML and edit authentication settings on the Splunk search head.

1. Configure SAML SSO with:

• Ping Idenity.
• Okta.
• Azure AD or AD FS.

2. Map SAML groups to Splunk Enterprise roles.