Configure SSO with Microsoft Azure AD or AD FS as your Identity Provider

If you use Microsoft Azure Active Directory or AD FS as your Identity Provider (IdP), follow these instructions to configure the Splunk platform for single sign-on using SAML as the authentication scheme.

After you configure the Splunk platform for SSO, you can map groups from the IdP to those roles so that users can log in. See Map groups on a SAML identity provider to Splunk user roles so that users in those groups can log in.

For information about configuring Microsoft Azure AD as an IdP, consult the Microsoft Azure documentation.

Prerequisites for configuring the Splunk platform to use Microsoft Azure AD as an identity provider

Following are the prerequisites for configuring the Splunk platform to use Microsoft Azure AD as an identity provider:

• You must have administrator access to Microsoft Azure.
• You must create a SAML application within Microsoft Azure.
• The application must have at least one user set up within it for testing purposes.
• In the application, you must provide several SAML attributes as well as the sign-on, identifier, and reply URLs for your Splunk platform instance.

Because the instructions for these differ based on your specific use case with Microsoft Azure, it is outside the scope of this topic to provide step-by-step instructions on how to set up Microsoft Azure for Splunk platform operations. See the following topics for detailed instructions on setting up the Azure idP:

• Quickstart: Add an enterprise application on the Microsoft Azure documentation site.

The documentation for setting up a SAML enterprise application in Microsoft Azure might change without notice due to changes in the Azure product.

Considerations for configuring the Splunk platform to use Microsoft Azure AD as an identity provider

When you configure Microsoft Azure as an IdP, review the following suggestions when configuring groups for the IdP:

• Consult the Azure IdP documentation and confirm that you have met the IdP configuration requirements.
• For Azure AD, you might need to append /SAML/acs to the end of the reply URL in the Azure application setup page.
• For Azure AD you might need to change the groupMembershipClaims from "null" to "SecurityGroup".
• When you use Azure AD FS as an IdP on Splunk Cloud Platform, you might need to set the Claim Type as "UPN" when you configure your IdP.
• You might experience a problem where the Splunk platform continuously re-authenticates into the IdP if the Splunk Web session timeout and the IdP vendor session timeout differ. This can cause users to lose work. To correct it, set the Splunk platform web session timeout to be equal to the IdP vendor session timeout.
• An error in configuring SAML can result in users being locked out of Splunk Cloud Platform. Use the following link to access the local login using native authentication if you are locked out. In the link, replace <name> with your account name:

  https://<name>.splunkcloud.com/en-US/account/login?loginType=splunk

• When you later map SAML groups to Splunk roles after you configure the Splunk platform to use Azure for authentication, you must map the roles to the group ID, or universally unique identifier (UUID), and not the group name, since groups can share the same name. When you map roles to the group ID, this ensures that you map the correct Azure group to your role.

Configure the Splunk platform for SAML

The following instructions presume that you have already configured the SAML application in Microsoft Azure. If you have not, complete those steps first. The Splunk platform cannot authenticate into Azure AD without you having completed those steps first. See "Prerequisites for configuring the Splunk platform to use Microsoft Azure AD as an identity provider" earlier in this topic.

1. Verify that your system meets all of the requirements. See Configure single sign-on with SAML.
2. In the Settings menu, select Authentication methods.
3. Select SAML as your authentication type.
4. Click Configure Splunk to use SAML.
5. On the SAML Groups page, click SAML Configuration.
6. Download or browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP's documentation if you are not sure how to get your metadata file.
7. In General Settings, provide the following information.

   Single Sign on URL.	This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk Enterprise sends authentication requests. Your users also use this URL for SSO login. To access the login page once SAML is enabled, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to splunkweb:port/en-US/account/login?loginType=Splunk
   Single Log Out URL.	This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out.
   IdP certificate path	This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk software uses that file to validate authenticity of SAML response. If you provide a directory, Splunk looks at all the certificates in the directory and tries to validate SAML response with each one of them. If validation fails, authentication fails.
   IdP certificate chains	If you use a certificate chain, order them as follows: 1. Root 2. Intermediate 3. Leaf
   Replicate certificates	Check this to replicate your IdP certificates in a search head cluster. When configuring SAML on a search head cluster, you must use the same certificate for each search head.
   Issuer Id	This is the Entity Id of the IdP. See your IdP documentation if you are not sure where to find this information.
   Entity ID.	This field is the entity ID as configured in the SP connection entry in your IdP.
   Sign AuthRequest.	Select this option.
   Sign SAML Response.	Select this option.

8. Skip the Attribute Query section.
9. In the Alias section optionally provide the following aliasing information:

   Role Alias	Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes.
   Real Name Alias	You may skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name.
   Mail Alias	Skip this field.

10. Populate the advanced section only if you need to set up load balancing or change the SAML binding. See Configure load balancing or SAML bindings
11. Click Save.

Next step

Map SAML groups to Splunk Enterprise roles