Configure SSO with Optimal as your identity provider
You can set up single sign-on (SSO) for Splunk Enterprise if you configured Optimal as your Identity Provider (IdP). For information about configuring Optimal as an IdP, consult the Optimal documentation. Perform the following steps to configure Splunk to recognize and use your Optimal configuration. Then authorize groups on that IdP to log into the Splunk platform. For instructions, see Map groups of Optimal users to Splunk user roles.
- Make sure your system meets the requirements. See Configure single sign-on with SAML.
- Make sure the
enableSplunkWebSSLsetting is enabled in $SPLUNK_HOME/etc/system/local/web.conf, otherwise this process fails.
- In Splunk Web, click Settings > Access Controls > Authentication method.
- Select SAML as your authentication type.
- Click Configure Splunk to use SAML.
- On the SAML Groups page, click SAML Configuration.
- Download or browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP documentation if you're not sure how to get your metadata file.
- In General Settings, provide the following information:
Setting Description Single Sign on URL This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk sends authentication requests. If you are using Splunk Cloud, open a support ticket to have the Splunk Cloud operations team open the port for communicating with the IdP.
Your users use this URL for SSO login.
To access the login page once SAML is enabled, append the full login URL (
loginType=Splunk. Users can also log into their local Splunk account by navigating directly to – splunkweb:port/en-US/account/login?loginType=Splunk
Single Log Out URL This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out. IdP's certificate path This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk uses that file to validate authenticity of SAML response. If you provide a directory, Splunk looks for all the certificates that are present as children of the directory and tries to validate SAML response with each one of them, if Splunk fails to validate authenticity with all of them, response is not considered authentic. IdP certificate chains If you use a certificate chain, order them as follows:
Replicate certificates Check this to replicate your IdP certificates in a search head cluster. When configuring SAML on a search head cluster, you must use the same certificate for each search head. Issuer Id The entity ID of the IdP. See your IdP documentation if you are not sure where to find this information. Entity ID. The entity ID as configured in the SP connection entry in your IdP. Sign AuthRequest Select this option. Sign SAML Response. Select this option.
- Skip the Attribute Query section and proceed to the next step.
- (Optional) In the Alias section, provide the following aliasing information:
Role Alias Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes. Real Name Alias You can skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name. Mail Alias Skip this field.
- Populate the advanced section only if you need to set up load balancing or change the SAML binding. See Configure load balancing or SAML bindings.
- Click Save.
Note: An error in configuring SAML could result in users and admins being locked out of Splunk Cloud. Use the following link to access the local login and revert to None for authentication if you're locked out:
https://<name>.splunkcloud.com/en-US/account/login?loginType=splunk [replace <name> with your account name]
Configure SSO with OneLogin as your identity provider
Configure SSO in CA siteminder
This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.1.0, 8.1.1, 8.1.2