Splunk® Enterprise

Securing Splunk Enterprise

Acrobat logo Download manual as PDF


Splunk Enterprise version 8.0 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Acrobat logo Download topic as PDF

Configure SSO with OneLogin as your identity provider

If you use OneLogin as your Identity Provider (IdP), follow these instructions to configure the Splunk platform for single sign-on.

After you configure the Splunk platform for SSO, you can map groups form the IdP to those roles so that users can log in. See Map groups on a SAML identity provider to Splunk user roles so that users in those groups can log in.

For information about configuring OneLogin as an IdP, consult your OneLogin documentation.

Considerations for configuring the Splunk platform to use OneLogin as an identity provider

  • An error in configuring SAML can result in users being locked out of Splunk Cloud Platform. Use the following link to access the local login using native authentication if you are locked out. In the link, replace <name> with your account name:
    https://<name>.splunkcloud.com/en-US/account/login?loginType=splunk

Configure the Splunk platform to use SAML

  1. Verify that your system meets all of the requirements. See Configure single sign-on with SAML.
  2. In the Settings' menu, select Authentication methods
  3. Select SAML as your authentication type.
  4. Click Configure Splunk to use SAML.
  5. On the SAML Groups page, click SAML Configuration.
  6. Download or browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP's documentation if you are not sure how to get your metadata file.
  7. In General Settings, provide the following information.
    Single Sign on URL. This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which the Splunk platform sends authentication requests.

    To access the login page once SAML is enabled, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to – splunkweb:port/en-US/account/login?loginType=Splunk

    Single Log Out URL. OneLogin supports redirect binding for single log out. Set the binding to 'HTTPRedirect'.
    IdP's certificate path This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk uses that file to validate authenticity of SAML response. If you provide a directory, Splunk looks for all the certificates that are present as children of the directory and tries to validate SAML response with each one of them, if Splunk fails to validate authenticity with all of them, response is not considered authentic.
    IdP certificate chains If you use a certificate chain, order them as follows:

    1. Root

    2. Intermediate

    3. Leaf

    Replicate certificates Check this to replicate your IdP certificates in a search head cluster. When configuring SAML on a search head cluster, you must use the same certificate for each search head.
    Issuer Id This is the Entity Id of the IdP. See your IdP documentation if you are not sure where to find this information.
    Entity ID. This field is the entity ID as configured in the SP connection entry in your IdP.
    Sign AuthRequest. ISet this value to false.
    Sign SAML Response. Set this value to false.
  8. Skip the Attribute Query section.
  9. In the Alias section optionally provide the following aliasing information:
    Role Alias Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes.
    Real Name Alias You may skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name.
    Mail Alias Skip this field.
  10. Populate the advanced section only if you need to set up load balancing or change the SAML binding. See Configure load balancing or SAML bindings
  11. Click Save.

Next step

Map SAML groups to Splunk Enterprise roles

Last modified on 19 October, 2021
PREVIOUS
Configure SSO with Microsoft Azure AD or AD FS as your Identity Provider
  NEXT
Configure SSO with Optimal as your identity provider

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.5, 8.0.10, 7.2.1, 7.0.1, 8.0.4, 8.0.9, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.2.0, 8.0.6, 8.0.7, 8.0.8


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters