Troubleshoot SAML SSO
Here are some common issues and how to resolve them.
Error message: SAML fails to verify assertions
You see the following error message:
Failed to verify the assertion - The 'Audience' field in the saml response from the IdP does not match the configuration
1. Verify the message and get more information by running the following search:
index=_internal host=sh* sourcetype=splunkd SAML
You should see the following:
09-18-2017 14:58:06.939 +0000 ERROR Saml - Failed to verify the assertion - The 'Audience' field in the saml response from the IdP does not match the configuration, Error details=Expected=https://<instance_name>.com, found=https://<wrong_instance_name>.com/
authentication.conf with the
entityId found in the error message in step 1.
[saml] entityId= https://<instance_name>.com/ (found from ERROR message)
authentication.conf from Splunk Web at Settings > Access Controls > Authentication Method > Reload Authentication configuration
Error message: Leaf certificate does not match
You receive the following message:
No leaf certificate matched one from the assertion
This error occurs when the signature certificate on Splunk does not match the certificate that the IdP uses to sign SAML messages.
If your signature verification certificate is a self-signed certificate:
Make sure that the certificate specified in the
idpCertPath attribute in
authentication.conf is the same as the certificate the IdP uses to sign SAML messages. You can use OpenSSL to determine the details of the certificate that Splunk uses for signature verification.
For example, the following command:
openssl x509 -in etc/auth/idpCerts/idpCert.pem -text -noout | grep 'Serial\|Issuer:\|Subject:'
Should produce information similar to this:
Serial Number: 1478287046063 (0x15830c635af) Issuer: C=US, ST=CA, L=San Francisco, O=Splunk, OU=Splunk Service, CN=5165ffd1bf1a0363c8a5cd8062337fb4 Subject: C=US, ST=CA, L=San Francisco, O=Splunk, OU=Splunk Service, CN=5165ffd1bf1a0363c8a5cd8062337fb4
If the signature verification certificate is part of a certificate chain
Make sure that the signing certificates match and are consistently named. For example, a simple chain would have three files in the following order:
- the root CA, for example: "
- the intermediate certificate, for example: "
- the leaf certificate or the signing certificate, for example: "
In this example, make sure that the "
cert_3.pem" (the leaf) is the same certificate that the IdP uses to sign responses.
If you have multiple chains, or chains with more than one intermediate CA
In most cases, the certificate chain consist of a single root certificate, a single intermediate certificate, and a single signing certificate. However, you may have multiple chains configured, or more than one intermediate CA.
If you have multiple chains configured, structure your certificate chain as follows:
$SPLUNK_HOME/etc/auth/idpCerts idpCertChain_1 idpCertChain_2 $SPLUNK_HOME/etc/auth/idpCerts/idpCertChain_1 cert_1.pem cert_2.pem cert_3.pem $SPLUNK_HOME/etc/auth/idpCerts/idpCertChain_2 cert_1.pem cert_2.pem cert_3.pem
If you have more than one intermediate CA
If you have more than one intermediate CA, structure your certificate chain as follows:
$SPLUNK_HOME/etc/auth/idpCerts idpCertChain_1 $SPLUNK_HOME/etc/auth/idpCerts/idpCertChain_1 cert_1.pem cert_2.pem cert_3.pem cert_4.pem cert_5.pem
Error message: Attribute query request error
Issue: You experience the following message
ERROR AuthenticationManagerSAML - Requesting user info from ID returned an error. Error in Attribute query request, AttributeQueryTransaction err=Cannot resolve hostname, AttributeQueryTransaction descr=Error resolving: Name or service not known, AttributeQueryTransaction statusCode=502
- Make sure that the
cipherSuiteis specified correctly in the SAML stanza. For example:
cipherSuite = TLSv1+MEDIUM:@STRENGTH
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
- Make sure all SOAP password requirements are met.
- Make sure your SSL settings for SAML are configured correctly in
Issue: You experience the following message:
ERROR AuthenticationManagerSAML - Attribute query request failed. Status code=urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal, Status msg=No attributes found for requested subject
- Make sure that the
realNameattributes are mapped to be returned back as part of
AuthnRequestand the Attribute Query Request.
Error message: SAML user missing roles
You experience the following message:
ERROR UserManagerPro - user="samluser1" had no roles
Make sure that
rolemap_SAML contains the correct role mapping with ";" at the end of each role name.
User cannot login
User cannot log in after successful assertion validation. No valid Splunk role is found in the local mapping or in the assertion.
- Make sure that
rolemap_SAMLstanza contains proper mapping between roles returned from IdP and the appropriate Splunk role.
- Make sure there are no spaces between, before, or after each role defined in
authentication.conf. For example:
user = User;Employee
User cannot access SAML login page
Authentication is configured as SAML and the settings appear to be correct, but the login screen shows the page for Splunk authentication instead.
- Make sure that in
appServerPortsis set to a valid port and not '0'.
- Make sure
web.confdoes not contain a value for
Error message: Failed to validate SAML logout response
When you log out of Splunk Enterprise or Splunk Cloud, you see the following error message:
Failed to validate SAML logout response received from IdP
This might be caused by case-sensitive IdPs that expect Splunk software to preserve uppercase letters in usernames. You can change the username to lowercase in the IdP or configure the IdP to accept the lowercase version of a username.
Cannot authenticate users for CLI commands
Unable to authenticate SSO users for CLI commands
You can add the SAML users as native Splunk users.
API and CLI commands cannot be performed by users that are defined only in SAML. This is because the user password is never sent in the SAML assertion.
SAML SSO best practices
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.3.0