Splunk® Enterprise

Securing the Splunk Platform

Acrobat logo Download manual as PDF

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Acrobat logo Download topic as PDF

Configure SSO with PingIdentity as your SAML identity provider

If you have use PingIdentity as your Security Assertion Markup Language (SAML) identity provider (IdP), you can follow these instructions to configure your Splunk platform instance for single sign-on.

For information about how to configure PingIdentity as an IdP, consult the PingFederate documentation.

If you configure SAML in error, this can result in the Splunk platform locking out users due to it sending invalid requests to the IdP. You can always use native Splunk Authentication to log into the instance if you encounter this problem. Use the following URL pattern to access your Splunk platform instance using native authentication:

https://<hostname>:<port>/en-US/account/login?loginType=splunk

Prerequisites for configuring the Splunk platform to use PingIdentity as a SAML identity provider

  1. Confirm that your Splunk platform instance meets all the basic requirements for using SAML as an authentication scheme. See Configure single sign-on with SAML.
  2. Confirm that you have exported a metadata file from the IdP.
  3. Confirm that the IdP session timeout and the SAML session timeout on The Splunk platform instance are the same. This ensures that both The Splunk platform and the IdP invalidate sessions simultaneously. See

Configure session timeouts with Ping Identity.

Procedure

  1. Log into Splunk Web if you have not already.
  2. In the system bar, select Access Controls > Authentication method.
  3. Under External, click SAML. A link Configure Splunk to use SAML appears.
  4. Click Configure Splunk to use SAML. The SAML configuration dialog box appears.
  5. In the General Settings section of the "SAML configuration" dialog box, in the Metadata XML File area, click Select File.
  6. Locate the metadata XML file that you downloaded from your IdP.
  7. Click Apply.
  8. In the General Settings section, provide the following information:
    Single Sign on URL This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk sends authentication requests.

    Your users use this URL for SSO login. To access the login page once SAML is enabled, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to splunkweb:port/en-US/account/login?loginType=Splunk

    Single Log Out URL. This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out.
    IdP certificate path This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk software uses that file to validate the SAML response. If you provide a directory, Splunk software looks for all the certificates in that directory and tries to validate the SAML response with each one of them. If any validation fails, the response is considered invalid.
    IdP certificate chains If you use a certificate chain, order them as follows:

    1. Root

    2. Intermediate

    3. Leaf

    Replicate certificates Check this to replicate your IdP certificates in a search head cluster. When configuring SAML on a search head cluster, you must use the same certificate for each search head.
    Issuer Id This is the Entity Id of the IdP. See your IdP documentation if you are not sure where to find this information.
    Entity ID. This field is the entity ID as configured in the service provider (SP) connection entry in your IdP.
    Sign AuthRequest. Select this option.
    Sign SAML Response. Select this option.
  9. (Optional) In Attribute Query Requests, provide the following information so you can create scheduled searches later:
    Attribute Query URL. (Optional) This is the endpoint on the IdP to which The Splunk platform sends queries over SOAP are sent. The format is as follows: <urn:oasis:names:tc:SAML:2.0:attrname-format:uri>
    Sign attribute query request Verify that this field is selected.
    Sign attribute query response Verify that this field is selected.
    Username Enter a user name.
    Provide a password.
  10. (Optional) In the Alias section, provide the following aliasing information:
    Role Alias Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes.
    Real Name Alias You may skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name.
    Mail Alias Skip this field.
  11. (Optional) Provide information in the Advanced Settings section only if you need to set up load balancing or change the SAML binding. See Configure advanced settings for SSO for more information.
  12. Click Save. The Splunk platform saves your configuration

Next Steps

After you configure PingIdentity as your SAML IdP, you can now map SAML groups to Splunk roles. See Map SAML groups to Splunk roles.

Last modified on 19 September, 2020
PREVIOUS
Configure single sign-on with SAML
  NEXT
Configure SSO with Okta as your identity provider

This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.1.0


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters