Secure SSO with TLS certificates

Configure the following SSL settings to enable Splunk Enterprise to perform TLS verification between Splunk Instance and the SOAP instance providing AttributeQuery service.

Unless noted, values not set default to the setting specified in server.conf.

[<saml-authSettings-key>]

sslVersions = <Comma-separated list of SSL versions to support>

sslCommonNameToCheck = <commonName> When populated, and 
sslVerifyServerCert is "true", splunkd limits most outbound HTTPS 
connections to hosts which use a cert with this common name. 

sslAltNameToCheck = <alternateName1>, <alternateName2>, ...If set, and 
sslVerifyServerCert' is "true", splunkd can verify certificates with 
"Subject Alternate Name" that matches any of the is alternate names in 
this list.

ecdhCurveName = <ECDH curve to use for ECDH key negotiation> 

serverCert = <Server certificate file> Default certificates, "sever.pem" are 
auto-generated by splunkd upon starting Splunk, you may replace the 
default cert with your own PEM format file.

sslPassword = <Server certificate password>

caCertFile = <Public key of the signing authority> The default value is cacert.pem 

caPath = <Path where all these certs are stored>. Default value is 
$SPLUNK_HOME/etc/auth

sslVerifyServerCert = [ true | false ] If true, distributed search makes a search 
request to another server in the search cluster. 

blacklistedAutoMappedRoles = <comma separated list of roles> Optionally provide a 
comma-separated list of Splunk roles that you do not want Splunk to auto-map if
received in the IDP Response.

blacklistedUsers = <comma separated list of user names> Optionally provide a
comma-separated list of user names that Splunk must reject from the IDP response.

nameIdFormat = <string> Optionally, and If supported by IDP,  specify the format of
the Subject returned in the SAML Assertion. 

ssoBinding = <HTTPPost | HTTPRedirect> Optionally specify the binding to use
when making a SP-initiated SAML request. The binding must match the one
configured on the IDP.

sloBinding = < <HTTPPost | HTTPRedirect> > Optionally specify the binding to
use when making a logout request or sending a logout response to complete 
the logout workflow. The binding must match the one configured on the IDP.

signatureAlgorithm = <RSA-SHA1 | RSA-SHA256> Optionally specify the signature
algorithm to user for a SP-initiated SAML request. 'signedAuthnRequest' must 
be set to true for this setting to take effect. The algorithm applies to both the  
http post and redirect binding.

inboundSignatureAlgorithm = <RSA-SHA1;RSA-SHA256,...> Optionally provide a 
semicolon-separated list of signature algorithms that are accepted in SAML 
responses. This setting affects both HTTP POST and HTTP Redirect binding.

replicateCertificates = <boolean> Optionally specify the IdP certificate files to 
replicate across search head cluster setup. Search head clustering must also 
be enabled. If certificate replication is not enabled, IdP certificate files must be 
replicated manually across SHC or verification of SAML signed assertions fails.