Configure SSO with PingIdentity as your SAML identity provider

If you have use PingIdentity as your Security Assertion Markup Language (SAML) identity provider (IdP), you can follow these instructions to configure your Splunk platform instance for single sign-on.

For information about how to configure PingIdentity as an IdP, consult the PingFederate documentation.

If you configure SAML in error, this can result in the Splunk platform locking out users due to it sending invalid requests to the IdP. You can always use native Splunk Authentication to log into the instance if you encounter this problem. Use the following URL pattern to access your Splunk platform instance using native authentication:

https://<hostname>:<port>/en-US/account/login?loginType=splunk

Prerequisites for configuring the Splunk platform to use PingIdentity as a SAML identity provider

1. Confirm that your Splunk platform instance meets all the basic requirements for using SAML as an authentication scheme. See Configure single sign-on with SAML.
2. Confirm that you have exported a metadata file from the IdP.
3. Confirm that the IdP session timeout and the SAML session timeout on The Splunk platform instance are the same. This ensures that both The Splunk platform and the IdP invalidate sessions simultaneously. See

Configure session timeouts with Ping Identity.

Procedure

1. Log into Splunk Web if you have not already.
2. In the system bar, select Settings > Authentication methods.
3. Under External, click SAML. A link Configure Splunk to use SAML appears.
4. Click Configure Splunk to use SAML. The SAML configuration dialog box appears.
5. In the General Settings section of the "SAML configuration" dialog box, in the Metadata XML File area, click Select File.
6. Locate the metadata XML file that you downloaded from your IdP.
7. Click Apply.
8. In the General Settings section, provide the following information:
   

   Single Sign on URL	This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk sends authentication requests. Your users use this URL for SSO login. To access the login page once SAML is enabled, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to splunkweb:port/en-US/account/login?loginType=Splunk
   Single Log Out URL.	This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out.
   IdP certificate path	This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk software uses that file to validate the SAML response. If you provide a directory, Splunk software looks for all the certificates in that directory and tries to validate the SAML response with each one of them. If any validation fails, the response is considered invalid.
   IdP certificate chains	If you use a certificate chain, order them as follows: 1. Root 2. Intermediate 3. Leaf
   Replicate certificates	Check this to replicate your IdP certificates in a search head cluster. When configuring SAML on a search head cluster, you must use the same certificate for each search head.
   Issuer Id	This is the Entity Id of the IdP. See your IdP documentation if you are not sure where to find this information.
   Entity ID.	This field is the entity ID as configured in the service provider (SP) connection entry in your IdP.
   Sign AuthRequest.	Select this option.

9. (Optional) In Attribute Query Requests, provide the following information so you can create scheduled searches later:
   

   Attribute Query URL.	(Optional) This is the endpoint on the IdP to which The Splunk platform sends queries over SOAP are sent. The format is as follows: <urn:oasis:names:tc:SAML:2.0:attrname-format:uri>
   Sign attribute query request	Verify that this field is selected.
   Sign attribute query response	Verify that this field is selected.
   Username	Enter a user name.
   Provide a password.

10. (Optional) In the Alias section, provide the following aliasing information:
    

    Role Alias	Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes.
    Real Name Alias	You may skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name.
    Mail Alias	Skip this field.

11. (Optional) Provide information in the Advanced Settings section only if you need to set up load balancing or change the SAML binding. See Configure advanced settings for SSO for more information.
12. Click Save. The Splunk platform saves your configuration
13. To reload the configuration, from the system bar, select Settings > Authentication methods from the system bar. When the Authentication methods page appears, select Reload authentication configuration.

Next Steps

After you configure PingIdentity as your SAML IdP, you can now map SAML groups to Splunk roles. See Map SAML groups to Splunk roles.