Splunk® Enterprise

Securing Splunk Enterprise

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Configure SSO with PingIdentity as your identity provider

This task describes how to set up SSO for Splunk Enterprise if you have configured PingIdentity as your Identity Provider (IdP). For information about configuring PingIdentity as an IdP, consult your Ping Federate documentation.

Use the following task to configure your Splunk deployment to recognize and use your PingIdentity configuration. Then, map groups of PingIdentity users to Splunk user roles so that those users can log in.

Prerequisites

Verify that your system meets all of the requirements. See Configure single sign-on with SAML.

Note that if you configure SessionNotOnOrafter (https://ping.force.com/Support/PingIdentityArticle?id=kA3400000008RdNCAU) you must configure the same timeout in the ui_inactivity_timeout attribute in web.conf and sessionTimeout in server.conf to match the IdP session timeout.

1. In the Settings menu, select Access Controls > Authentication method.

2. Select SAML as your authentication type.

3. Click Configure Splunk to use SAML.

4. On the SAML Groups page, click SAML Configuration.

5. Browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP's documentation if you are not sure how to get your metadata file.

6. In General Settings, provide the following information.

Single Sign on URL. This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk sends authentication requests.

Your users use this URL for SSO login. To access the login page once SAML is enabled, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to splunkweb:port/en-US/account/login/loginType=Splunk

Single Log Out URL. This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out.
IdP's certificate path This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk software uses that file to validate the SAML response. If you provide a directory, Splunk software looks for all the certificates in that directory and tries to validate the SAML response with each one of them. If any validation fails, the response is considered invalid.

When configuring SAML on a search head cluster, make sure you configure the same certificate for each search head.

Entity ID. This field is the entity ID as configured in the SP connection entry in your IdP.
Sign AuthRequest. Select this option.
Sign SAML Response. Select this option.

7. In Attribute Query, optionally provide the following information so you can create scheduled searches later.

Attribute Query URL. (Optional) This is the endpoint on the IdP to which queries over SOAP are sent. The format is as follows: <urn:oasis:names:tc:SAML:2.0:attrname-format:uri>
Sign attribute query request Verify that this field is selected.
Sign attribute query response Verify that this field is selected.

8. Populate the advanced section only if you need to set up load balancing or change the SAML binding. See Configure advanced settings for SSO.

9. Click Save.

Next Step

Map SAML groups to Splunk Enterprise roles

Note: An error in configuring SAML could result in users and admins being locked out of Splunk Cloud. Use this link to access the local login and revert back to None for authentication if you are locked out:

https://<name>.splunkcloud.com/en-US/account/login?loginType=splunk [replace <name> with your account name]

PREVIOUS
Configure single sign-on with SAML
  NEXT
Configure SSO with Okta as your identity provider

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10


Comments

If you are having problems with roles, then check to make sure they are sent in a DN format as suggested in this Splunk Answers post:
https://answers.splunk.com/answers/319682/splunk-sso-with-pingfederatesaml-works-but-roles-n.html

Bartm002
September 7, 2016

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters