Related Answers
Download topic as PDF
Configure SSO with Okta as your identity provider
This task describes how to set up SSO for Splunk Enterprise if you have configured Okta as your Identity Provider (IdP). For information about configuring Okta as an IdP, consult your Okta documentation.
Use the following task to configure your Splunk deployment to recognize and use your Okta configuration. Then, map groups from the IdP to Splunk user roles so that those groups can log in.
Prerequisites
Verify that your system meets all of the requirements. See Configure single sign-on with SAML.
1. In the Settings menu, select Access Controls > Authentication method.
2. Select SAML as your authentication type.
3. Click Configure Splunk to use SAML.
4. On the SAML Groups page, click SAML Configuration.
5. Browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your Okta documentation if you are not sure how to locate your metadata file.
6. In General Settings, provide the following information:
Single Sign on URL. This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk Enterprise sends authentication requests. To access the login page once SAML is enabled, append the full login URL (
/account/login) withloginType=Splunk. Users can also log into their local Splunk account by navigating directly to – splunkweb:port/en-US/account/login?loginType=SplunkSingle Log Out URL. This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out. IdP's certificate path This value can be a directory or a single file, depending on your IdP requirements. If you provide a file, Splunk Enterprise uses that file to validate authenticity of SAML response. If you provide a directory, Splunk Enterprise looks at all the certificates in the directory and tries to validate SAML response with each one of them. If any validation fails, authentication fails. When configuring SAML on a search head cluster, make sure you configure the same certificate for each search head.
Entity ID. This field is the entity ID as configured in the SP connection entry in your IdP. Sign AuthRequest. Select this option. Sign SAML Response. Select this option.
7. Skip Attribute Query and go to steps 8 and 9.
8. In the Alias section optionally provide the following aliasing information:
In Alias, provide the following information:
Role Alias Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes. Real Name Alias You may skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name. Mail Alias Skip this field.
9. Populate the advanced section only if you need to set up load balancing or change the SAML binding. See Configure load balancing or SAML bindings
10. Click Save.
Next Step
Note: An error in configuring SAML could result in users and admins being locked out of Splunk Cloud. Use this link to access the local login and revert back to None for authentication if you are locked out:
https://<name>.splunkcloud.com/en-US/account/login?loginType=splunk [replace <name> with your account name]
|
PREVIOUS Configure SSO with PingIdentity as your identity provider |
NEXT Configure SSO with AzureAD or AD FS as your Identity Provider |
This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10
Comments
In Okta, set:
SSO URL: http://localhost:8000/saml/acs
Audience URI: http://localhost:8000
Attribute Statement:
role: admin [or better yet, use the Group Attribute Statements]
mail: user.email
then download the metadata
In Splunk:
import the Okta Metadata, then set:
SLO: https://YOUR_ORG.okta.com
Entity ID: http://localhost:8000
Thanks for catching this! I've updated the docs accordingly.
The doc states that the URL should be in this format “splunkweb:port/en-US/account/login/loginType=Splunk” but that is incorrect. The true format should be “splunkweb:port/en-US/account/login?loginType=Splunk”.
The doc shows a “/” character but it should be a “?” because “loginType” is a URL parameter which should be prefixed with a “?”. Can you please make sure that the docs are updated because it will cause problems for your users in the future. I suspect that the PDF docs as well as the web docs need to be fixed.
Okta can also send this attribute:
realName: user.firstName + " " + user.lastName