Splunk® Enterprise

Securing the Splunk Platform

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Configure SSO with OneLogin as your identity provider

This task describes how to set up single Sign-on (SSO) for Splunk Software if you have configured OneLogin as your Identity Provider (IdP). For information about configuring OneLogin as an IdP, consult your OneLogin documentation.

Use the following task to configure Splunk Software to recognize and use your OneLogin configuration. Then, map groups of OneLogin users to Splunk user roles so that those users can log into Splunk.


Verify that your system meets all of the requirements. See Configure single sign-on with SAML.

1. In the Settings menu, select Access Controls > Authentication method.

2. Select SAML as your authentication type.

3. Click Configure Splunk to use SAML.

4. On the SAML Groups page, click SAML Configuration.

5. Browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP's documentation if you are not sure how to get your metadata file.

6. In General Settings, provide the following information.

Single Sign on URL This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk Software sends authentication requests.

To access the login page once SAML is enabled, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to splunkweb:port/en-US/account/login/loginType=Splunk

Single Log Out URL OneLogin supports redirect binding for single log out. Set the binding to HTTPRedirect.
IdP's certificate path This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk Software uses that file to validate authenticity of SAML response. If you provide a directory, Splunk Software looks for all the certificates that are in the directory and tries to validate SAML response with each certificate. If Splunk Software fails to validate authenticity with the certificates, the response is not considered authentic.

When configuring SAML on a search head cluster, make sure you configure the same certificate for each search head.

Entity ID This field is the entity ID as configured in the SP connection entry in your IdP.
ISet this value to false.
Sign SAML Response Set this value to false.

7. Skip the Attribute Query section and go to steps 8 and 9.

8. Optionally populate the advanced section if you need to set up load balancing or change the SAML binding. See Configure load balancing or SAML bindings

9. Click Save.

Note: An error in configuring SAML could result in users and admins being locked out of Splunk Cloud. Use this link to access the local login and revert back to None for authentication if you are locked out:

https://<name>.splunkcloud.com/en-US/account/login?loginType=splunk [replace <name> with your account name]

Next Step

Map SAML groups to Splunk Enterprise roles

Last modified on 31 May, 2017
Configure SSO with AzureAD or AD FS as your Identity Provider
Configure SSO with Optimal as your identity provider

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters