Configure SSO in CA siteminder

This task describes how to set up SSO for Splunk if you have configured CA as your Identity Provider (IdP). For information about configuring CA as an IdP, consult your CA documentation.

Use the following task to configure Splunk to recognize and use your CA configuration. Then, map groups of CA users to Splunk user roles so that those users can log into Splunk.

Prerequisites

Verify that your system meets all of the requirements. See Configure single sign-on with SAML.

1. In the Settings menu, select Access Controls > Authentication method.

2. Select SAML as your authentication type.

3. Click Configure Splunk to use SAML.

4. On the SAML Groups page, click SAML Configuration.

5. Browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP's documentation if you are not sure how to get your metadata file.

6. In General Settings, provide the following information.

Single Sign on URL.	This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk sends authentication requests. To access the login page once SAML is enabled, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to – splunkweb:port/en-US/account/login/loginType=Splunk
Single Log Out URL.	This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out.
IdP's certificate path	This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk uses that file to validate authenticity of SAML response. If you provide a directory, Splunk looks for all the certificates that are present as children of the directory and tries to validate SAML response with each one of them, if Splunk fails to validate authenticity with all of them, response is not considered authentic. When configuring SAML on a search head cluster, make sure you configure the same certificate for each search head.
Entity ID.	This field is the entity ID as configured in the SP connection entry in your IdP.
Sign AuthRequest.	Select this option.
Sign SAML Response.	Select this option.

7. Skip the Attribute Query and go to steps 8 and 9.

8. Populate the advanced section only if you need to set up load balancing or change the SAML binding. See Configure load balancing or SAML bindings

9. Click Save.

Note: An error in configuring SAML could result in users and admins being locked out of Splunk Cloud. Use this link to access the local login and revert back to None for authentication if you are locked out:

https://<name>.splunkcloud.com/en-US/account/login?loginType=splunk [replace <name> with your account name]

Next Step

Map SAML groups to Splunk Enterprise roles