Map groups on a SAML identity provider to Splunk roles

After you configure a Splunk platform deployment to use a Security Assertion Markup Language (SAML) identity provider (IdP) for authentication, you can then authorize groups on that IdP to log into the Splunk platform instance by mapping those groups to Splunk roles. You can map multiple groups on the IdP to a single Splunk role.

This is the only way to give users on your IdP access to the Splunk platform deployment. You cannot give individual users on the IdP access to the Splunk platform deployment unless you create a group on the IdP for the user, or add the user to an existing group.

Prerequisites for mapping SAML groups to Splunk roles

Confirm that you have completed the following steps before you attempt to map groups on your IdP to roles on your Splunk platform deployment:

• The identity provider you have is SAML version 2.0 compliant
• You have configured your IdP to supply the necessary attributes in an assertion that it sends
• You have configured your Splunk platform deployment to use the IdP as an authentication scheme.

For more specifics on these prerequisites, see Configure single sign-on with SAML.

Considerations for mapping SAML groups to Splunk roles

Depending on the SAML IdP that you use for authentication, you might need to make following considerations to ensure that authentication through SAML works properly.

Considerations for mapping groups to Splunk roles with Microsoft Azure as the identity provider

When you map SAML groups to Splunk roles, you must map the roles to the group ID, or universally unique identifier (UUID), and not the group name, since groups can share the same name. When you map roles to the group ID, this ensures that you map the correct group to your role.

The Splunk platform automtically maps SAML groups to Splunk roles with the same name

In an effort to ease administration for Splunk administrators who connect their Splunk platform instances to SAML IdPs, the Splunk platform automatically maps groups that it encounters on the SAML IdP to Splunk roles that have the same name. For example, if your IdP has an 'user' group, when you connect the Splunk platform instance to your SAML IdP, it automatically maps the 'user' group to the Splunk 'user' role, and all users in the IdP user group get access to the permissions of the Splunk 'user' role.

You can turn off the automapping functionality using either Splunk Web or configuration files on Splunk Enterprise. For the instructions using configuration files in Splunk Enterprise, see Configure automapping of SAML IdP groups to Splunk roles.

Toggle automapping of SAML groups to Splunk roles in Splunk Web

Use the following procedure to turn on or turn off automapping of groups on a SAML IdP to Splunk roles.

1. In the system bar, click Settings > Authentication Methods.
2. Under External, confirm that the SAML checkbox is selected.
3. Click Configure Splunk to use SAML.
4. In the SAML Configuration dialog box, under General settings:
   • To turn on automatic role mapping of SAML groups to Splunk roles, select the Enable Auto Mapped Roles check box.
   • To turn off automatic role mapping of SAML groups to Splunk roles, unselect the Enable Auto Mapped Roles check box.
5. Select Save. The change takes effect immediately.

Map groups on a SAML identity provider to Splunk roles

1. In the system bar, click Settings > Authentication Methods.
2. Under External, confirm that the SAML checkbox is selected.
3. Click Configure Splunk to use SAML.
4. Click Cancel to close the SAML Configuration dialog box and show the SAML groups page.
5. Click New Group, or click Edit if you want to modify an existing SAML group.
6. If you are creating a new group, in the Group Name field, enter the name of the group. Typically, this is the name of a group on the IdP.
7. In the Splunk Roles section, choose the Splunk roles to which you want this group to map by clicking one or more of the roles in the Available item(s) column.
8. Click Save. Splunk Web saves the group and returns you to the SAML Groups page.

After you configure SAML SSO and map groups to Splunk roles, you can distribute the login URL to users on your identity provider.