Splunk® Enterprise

Securing Splunk Enterprise

Download manual as PDF

Download topic as PDF

Configure SAML SSO for other IdPs

Any identity provider that is compliant with version 2.0 of the Security Assertion Markup Language (SAML) should be configurable with SAML on the Splunk platform. For information about supported and tested IdPs, see How SAML SSO works.

The following topic provides general instructions for configuring an IdP to work with Splunk Enterprise. There might be exceptions or differences in the process of configuring an IdP to work with Splunk Enterprise, depending upon the IdP you use. For assistance with configuration procedures that are not documented in this chapter, contact Splunk Support.

When you configure the Splunk platform to use your SAML authentication system, you can authorize groups on your IdP to log in by mapping them to Splunk user roles.

SAML does not support encryption.

Prerequisites

Verify that your system meets all of the requirements. See Configure single sign-on with SAML.

  1. In the Settings menu, select Access Controls > Authentication method.
  2. Select SAML as your authentication type.
  3. Click Configure Splunk to use SAML.
  4. On the SAML Groups page, click SAML Configuration.
  5. Browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP's documentation if you are not sure how to get your metadata file.
  6. In General Settings, provide the following information.
    Single Sign on URL. This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk sends authentication requests. Your users use this URL for SSO login.

    To access the login page once SAML is enabled, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to splunkweb:port/en-US/account/login?loginType=Splunk

    Single Log Out URL. This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out.
    IdP's certificate path This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk uses that file to validate authenticity of SAML response. If you provide a directory, Splunk looks for all the certificates that are present as children of the directory and tries to validate SAML response with each one of them, if Splunk fails to validate authenticity with all of them, response is not considered authentic.

    When configuring SAML on a search head cluster, make sure you configure the same certificate for each search head.

    Entity ID. This field is the entity ID as configured in the SP connection entry in your IdP.
    Sign AuthRequest. Select this option.
    Sign SAML Response. Select this option.
  7. If you use PingIdentity as your IdP, in Attribute Query, provide the following information so you can create scheduled searches later. These fields are not required for creating scheduled searches with Okta, Azure AD, or AD FS.
    Attribute Query URL. This field is the endpoint on the IdP to which queries over SOAP are sent. The format is as follows: <urn:oasis:names:tc:SAML:2.0:attrname-format:uri>
    Sign attribute query request Verify that this field is selected.
    Sign attribute query response Verify that this field is selected.
  8. In Advanced settings, provide the following information.
    Attribute Alias Role Use this field to specify a new attribute name on any IdP and then configure an alias on the Splunk side for any of the 3 attributes.

    If you have configured the AD FS built-in "Role" attribute to be returned and this has the AD group information, specify http://schemas.microsoft.com/ws/2008/06/identity/claims/role. This value tells Splunk the attribute that contains the role information in the SAML response returned.

    If you have configured Azure AD, specify http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.

    Attribute Alias Real Name Populate this field if you use Azure AD as your IdP. This value tells Splunk Enterprise where to map the real name in the SAML response returned. Enter http://schemas.microsoft.com/identity/claims/displayname.
    Attribute Alias Mail Populate this field if you use Azure AD as your IdP. This value maps the alias to the user email addresses in the SAML response returned. Enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.
    FQDN - Host Name or IP of the load balancer Set to: https://sh1.STACKID.splunkcloud.com. This setting works for a Splunk deployment with Single Search Head Setup or a Search Head Cluster Setup. You must provide an address if you use load balancing with a search head cluster.
    (Optional) Redirect Port Provide a redirect port for the load balancer described in the previous field. For Okta set it to "0" (Zero).
  9. Click Save.

Next Steps

Map SAML groups to Splunk Enterprise roles

PREVIOUS
Configure Ping Identity with leaf or intermediate SSL certificate chains
  NEXT
Configure advanced settings for SSO

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters