Configure SSO with Okta as your identity provider

If you use Okta as your Identity Provider (IdP), follow these instructions to configure the Splunk platform for single sign-on.

After you configure the Splunk platform for SSO, you can map groups from the IdP to those roles so that users can log in. See Map groups on a SAML identity provider to Splunk user roles so that users in those groups can log in.

To configure the Splunk platform to also delete its users when you delete users on the IdP, follow the procedure at "Configure the Splunk platform to remove users on Okta" later in this topic.

For information about configuring Okta as an IdP, consult the Okta documentation.

1. Confirm that your system meets all of the requirements. See Configure single sign-on with SAML.
2. In the Settings menu, select Authentication methods.
3. Select SAML as your authentication type.
4. Click Configure Splunk to use SAML.
5. On the SAML Groups page, click SAML Configuration.
6. Download or browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your Okta documentation if you are not sure how to locate your metadata file.
7. In General Settings, provide the following information:

   Single Sign on URL.	This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk Enterprise sends authentication requests. To access the login page once SAML is enabled, append the full login URL (/saml/acs) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to – splunkweb:port/en-US/account/login?loginType=Splunk
   Single Log Out URL.	This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out.
   IdP's certificate path	This value can be a directory or a single file, depending on your IdP requirements. If you provide a file, Splunk Enterprise uses that file to validate authenticity of SAML response. If you provide a directory, Splunk Enterprise looks at all the certificates in the directory and tries to validate SAML response with each one of them. If any validation fails, authentication fails.
   IdP certificate chains	If you use a certificate chain, order them as follows: 1. Root 2. Intermediate 3. Leaf
   Replicate certificates	Check this to replicate your IdP certificates in a search head cluster. When configuring SAML on a search head cluster, you must use the same certificate for each search head.
   Issuer Id	This is the Entity Id of the IdP. See your IdP documentation if you are not sure where to find this information.
   Entity ID.	This field is the entity ID as configured in the SP connection entry in your IdP.
   Sign AuthRequest.	Select this option.
   Sign SAML Response.	Select this option. If '''Request Compression''' is set, when you log onto Splunk Web on a Search Head, you are diverted to Okta Applications rather than the Search Head.

8. Skip Attribute Query.
9. In the Alias section optionally provide the following aliasing information: In Alias, provide the following information:

   Role Alias	Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes.
   Real Name Alias	You may skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name.
   Mail Alias	Skip this field.

10. Populate the advanced section only if you need to set up load balancing or change the SAML binding. See Configure load balancing or SAML bindings.
11. Click Save

An error in configuring SAML can result in users and admins being locked out of the Splunk platform. Use the following URL to access the local login and revert to native authentication if the instance locks you out:

https://<accountname>.splunkcloud.com/en-US/account/login?loginType=splunk

Configure the Splunk platform to remove users on Okta

By default, the Splunk platform does not automatically keep users in sync with Okta. It does not remove users on the Splunk side that no longer exist on the IdP. With system for cross-domain identity management (SCIM), you can configure the Splunk platform to sync user deletions from the IdP.

This procedure requires coordination with the administrator of your IdP. Before you can use SCIM for automated user management with SAML, your IdP administrator must turn on SCIM in the SAML application on the IdP. Then you must configure the Splunk platform with information that your IdP administrator provides.

Some Okta SAML applications might not support SCIM. Consult with your Okta IdP administrator or Okta for a better understanding of which Okta SAML applications support the SCIM process. If the Okta SAML application does not support SCIM, then the Splunk platform cannot use the application to perform local user account removal.

After you configure SCIM, the Splunk platform deletes its users after you delete them from the IdP. Depending on the authentication type that your IdP administrator uses for SCIM, delete operations can take up to one hour to process.

1. Provide the IdP administrator with the URL of the SCIM client. In general, the URL has the following format:
   

   https://<splunk-server>/en-US/splunkd/__raw/services/identity/provisioning/v1/scim/v2

2. The IdP administrator must enable SCIM in the SAML application that the Splunk platform uses for authentication. They use the SCIM client URL that you give them as part of this process. They have three options to perform authentication requests through SCIM:
   
   1. Splunk authentication, using a Splunk username and password.
   2. HTTP header authentication, using a Bearer authorization token.
   3. Open Authorization (OAuth) v2.0, using the access token endpoint and authorization endpoint URIs, a client ID, and a client secret.
3. If the IdP administrator uses OAuth 2.0 to process SCIM requests, they will provide you with the Issuer URL and the Client ID.
4. Log into the Splunk platform instance where you want to enable SCIM.
5. From the system bar, select Settings > Authentication Methods.
6. Select SAML settings.
7. Select SAML Configuration.
8. Select the triangle next to Automated User Management. Options for automated user management appear.
9. Select Enable SCIM and confirm that the box is checked.
10. (Optional) If the IdP administrator provided you with the Issuer URL and Client ID for OAuth 2.0, enter the values into the OAuth Issuer URL and OAuth Client ID fields, respectively.
11. (Optional) If necessary, complete the SAML configuration settings for the Splunk platform by updating fields for your specific authentication application.
12. Select Save. The update takes effect immediately.

Next steps

Map SAML groups to Splunk Enterprise roles