Configure SSO in Computer Associates (CA) SiteMinder
If you use CA SiteMinder as your Identity Provider (IdP), follow these instructions to configure the Splunk platform for single sign-on.
After you configure the Splunk platform for SSO, you can map groups form the IdP to those roles so that users can log in. See Map groups on a SAML identity provider to Splunk user roles so that users in those groups can log in.
For information about configuring CA SiteMinder as an IdP, consult the CA documentation.
Prerequisites and considerations for configuring the Splunk platform to use CA SiteMinder as an identity provider
- An error in configuring SAML can result in users being locked out of Splunk Cloud Platform. Use the following link to access the local login using native authentication if you are locked out. In the link, replace <name> with your account name:
Configure the Splunk platform to use SAML
- Verify that your system meets all of the requirements. See Configure single sign-on with SAML.
- In the Settings menu, select Authentication methods.
- Select SAML as your authentication type.
- Click Configure Splunk to use SAML.
- On the SAML Groups page, click SAML Configuration.
- Download or browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP documentation if you are not sure how to get your metadata file.
- In General Settings, provide the following information.
Single Sign on URL. This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk sends authentication requests.
loginType=Splunk. Users can also log into their local Splunk account by navigating directly to – splunkweb:port/en-US/account/login?loginType=Splunk
Single Log Out URL. This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out. IdP's certificate path IdP certificate chains If you use a certificate chain, order them as follows:
Replicate certificates Issuer Id Entity ID. This field is the entity ID as configured in the SP connection entry in your IdP. Sign AuthRequest. Select this option. Sign SAML Response. Select this option.
- Skip the Attribute Query section.
- In the Alias section optionally provide the following aliasing information:
Role Alias Real Name Alias You may skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name. Mail Alias Skip this field.
- Populate the advanced section only if you need to set up load balancing or change the SAML binding. See Configure load balancing or SAML bindings
- Click Save.
Configure SSO with Optimal as your identity provider
Secure SSO with TLS certificates
This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.2.0, 8.2.1, 8.2.2, 8.2.3