Best practices for using SAML as an authentication scheme for single-sign on

Following are some best practices to ensure that you have the most secure experience when you configure the Splunk platform to use Security Assertion Markup Language as an authentication scheme.

Many of these best practices work for both Splunk Cloud Platform and Splunk Enterprise. As a Splunk Cloud Platform user, you must open a support ticket to make changes to your instance with configuration files.

1. Always enable SSL for Splunk Web. This ensures that all communications between your browser, your Splunk platform instance, and your identity provider (IdP) are secure.
2. Enable authentication request signing to ensure that all SAML responses, for example Attribute Query Requests (AQR), assertions, and logout responses, are encrypted.




3. For SAML responses from your IdP, use an SSL certificate chain, rather than a group of self-signed certificates.
4. Configure your identity provider (IdP) to use HTTP POST or redirect binding for SAML responses that the IdP sends to the Splunk platform. With redirect binding active, the Splunk platform verifies the SAML response against the end-entity, or leaf, certificate that you installed on the instance. The Splunk platform does not perform certificate revocation list (CRL) validation during response verification.




5. Make sure that all of your certificates are valid, and have not expired or been revoked.
6. Configure user exclude lists to ensure that accounts in the exclude list cannot log in or remain logged in. You can do this with the authentication.conf configuration file.

   blacklistedUsers = <comma-separated list of user names from the response that the Splunk platform is to exclude>
   

7. Set a list of non-trusted users that are in control of IdP group names. For example, you can limit access by specifying that Splunk roles such as admin and power are added to the auto-mapped rules section. You do this with the authentication.conf configuration file.

   blacklistedUsers = <Comma-separated list of user names from the IDP response that the Splunk platform is to exclude>
   

8. The Splunk platform supports auto-mapped roles by default. If the IdP returns Splunk roles in an assertion, the Splunk platform uses them. To turn off auto-mapping for roles, add the list of roles to the blacklistedAutoMappedRoles setting in authentication.conf.

   blacklistedAutoMappedRoles = <Comma separated list of Splunk roles from the IDP Response that should be prevented from being auto-mapped by the Splunk platform.>
   

9. Do not assign the admin role to the defaultRolesIfMissing setting in the authorize.conf configuration file. The Splunk platform temporarily uses the admin role to send group information in the SAML assertion until the IdP is configured.