Splunk® Enterprise

Securing Splunk Enterprise

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Configure SSO with AzureAD or AD FS as your Identity Provider

This task describes how to set up SSO for Splunk deployments if you have configured AzureAD or ADFS as your Identity Provider (IdP). Verify that your system meets all of the requirements for IdP and SAML. See Configure single sign-on with SAML.

When configuring your IdP, note the following suggestions when configuring your groups:

  • Before you begin, be sure to consult your IdP documentation and ensure that you have met the IdP configuration requirements.
  • For AzureAD the reply URL may require /SAML/acs on the end.
  • For AzureAD you may need to change the groupMembershipClaims from null to SecurityGroup.
  • For AD FS for Splunk Cloud, you may need to set the Claim Type as "UPN" when configuring your IdP. The Splunk blog post at https://www.splunk.com/blog/2016/09/14/configuring-microsofts-adfs-splunk-cloud.html provides more information about configuring AD FS for Cloud.

Use the following task to configure your Splunk deployment to recognize and use your AzureAD or AD FS configuration. Then, map groups of AzureAD or AD FS users to Splunk user roles so that those users can log in.

Configure Splunk Software for SAML

1. In the Settings menu, select Access Controls > Authentication method.

2. Select SAML as your authentication type.

3. Click Configure Splunk to use SAML.

4. On the SAML Groups page, click SAML Configuration.

5. Browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP's documentation if you are not sure how to get your metadata file.

6. In General Settings, provide the following information.

Single Sign on URL. This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk Enterprise sends authentication requests.

Your users also use this URL for SSO login. To access the login page once SAML is enabled, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to splunkweb:port/en-US/account/login/loginType=Splunk

Single Log Out URL. This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out.
IdP's certificate path This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk software uses that file to validate authenticity of SAML response. If you provide a directory, Splunk looks at all the certificates in the directory and tries to validate SAML response with each one of them. If validation fails, authentication fails.

When configuring SAML on a search head cluster, make sure you configure the same certificate for each search head.

Entity ID. This field is the entity ID as configured in the SP connection entry in your IdP.
Sign AuthRequest. Select this option.
Sign SAML Response. Select this option.

7. Skip the Attribute Query section and go to steps 8 and 9.

8. In the Alias section optionally provide the following aliasing information:

Role Alias Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes.
Real Name Alias You may skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name.
Mail Alias Skip this field.

9. Populate the advanced section only if you need to set up load balancing or change the SAML binding. See Configure load balancing or SAML bindings

10. Click Save.

Next Step

Note: An error in configuring SAML could result in users and admins being locked out of Splunk Cloud. Use this link to access the local login and revert back to None for authentication if you are locked out:

https://<name>.splunkcloud.com/en-US/account/login?loginType=splunk [replace <name> with your account name]

Map SAML groups to Splunk Enterprise roles

Configure SSO with Okta as your identity provider
Configure SSO with OneLogin as your identity provider

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10



Thanks for this feedback, it's very helpful. I've added this information in my communications with our dev side. I'll update the docs as soon as possible and let both you and Fdaly oneview know when I have clarification.


Jworthington splunk, Splunker
May 2, 2017

Hi Fdaly oneview,

Role Alias is an optional field that should not affect your configuration if you leave it blank. I've reached out to development to see what is going on behind the scenes that i can document more clearly.

Jworthington splunk, Splunker
May 2, 2017

We've also encountered the "Saml response does not contain group information." error using ADFS.

Looking at the SAML exchanges we noticed groups are listed within '<Attribute Name="http://schemas.xmlsoap.org/claims/Group">...</Attribute>' so in the Splunk SAML configuration we set "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" as "Role Alias" and all started to work perfectly.

April 26, 2017

This document appears to be incomplete. Using 6.5.3 when I apply the above guide I end up with "Saml response does not contain group information." after being logging into Azure AD.

As best I can guess, there's a disconnect between the role mappings in Splunk and the Groups assigned application access in Azure AD.

I'm configuring it through the UI, not the underlying conf files. Splunk running on Windows.

Is it related to step 8 in this guide? The guidance for the "Role" alias says, "Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes.". What does that even mean? That's just a jumble of words that bears no resemblance to any nomenclature in Azure AD or Splunk.

Fdaly oneview
April 18, 2017

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters