Refresh expiring SAML identity provider certificates

When you configure the Splunk platform to use SAML as an authentication scheme, you can configure a certificate for your SAML identity provider. As with most security-related certificates, SAML IdP certificates expire after a period of time. When a certificate is due to expire, the Splunk platform notifies you of the upcoming expiration when you log into the Splunk platform instance.

If you don't replace your expiring IdP certificate with a new one, your Splunk Platform instance cannot connect to the IdP, and SAML logins fail. To prevent this problem, update your IdP certificate and replace it before the expiration date.

Upload a refreshed identity provider certificate to your Splunk platform instance

The general procedure for refreshing an IdP certificate on your Splunk platform instance follows. Depending on the IdP you use and whether you use a standalone certificate or certificate chain, the general procedure might differ slightly.

1. Log into your SAML identity provider and visit its configuration page.
2. In the configuration page for your IdP, generate a new IdP certificate or certificate chain
3. Save the certificate or certificate chain as a file.
4. Log into your Splunk platform instance and go to the SAML configuration page.
5. On the SAML configuration page, upload the certificate or certificate chain.
6. On the Settings > Authentication methods page, click "Reload authentication configuration."

Upload a standalone identity provider certificate to your Splunk platform instance

1. On your IdP, generate new IdP metadata and download the metadata file or copy the metadata file contents.
2. Log into your Splunk platform instance.
3. From the system bar, select Settings > Authentication Methods.
4. In the External section of the page that appears, select SAML.
5. Select the Configure Splunk to use SAML link that appears.
6. In the SAML configuration page, perform one of the following actions:
   • Under Metadata XML file, select Select file, the choose the IdP metadata file that you just saved, or
   • Under Metadata contents, paste the contents of the IdP metadata file you copied previously.
7. Select Apply.
8. Select Save to close the configuration page.
9. In the Authentication Methods page, select Reload authentication configuration.

Upload an identity provider certificate chain to your Splunk platform instance

1. On your IdP, generate the new IdP certificate.
2. As necessary, arrange your IdP certificate chain as follows:
   • Your certificate chain must be in the privacy-enhanced mail (PEM) format, with -----BEGIN CERTIFICATE----- and ----END CERTIFICATE----- around the text of each individual certificate.
   • You must arrange each certificate in the certificate chain as follows:
     • Root certificate
     • Any intermediate certificates
     • Leaf certificate
3. Log into your Splunk platform instance.
4. From the system bar, select Settings > Authentication Methods.
5. In the External section of the page that appears, select SAML.
6. Select the Configure Splunk to use SAML link that appears.
7. In the SAML configuration page, under IdP certificate chains, paste the contents of the IdP certificate chain into the text field.
8. Select Save to close the configuration page.
9. In the Authentication Methods page, select Reload authentication configuration.

Upload a refreshed Splunk SAML certificate to your identity provider

On identity providers that require a SAML certificate for processing of Splunk Cloud Platform logins and logouts, you can refresh the SAML certificate that Splunk provides by uploading it to your IdP. Where you upload the SAML certificate to your IdP depends on the IdP that you use.

1. As your Splunk Cloud Platform SAML certificate nears expiration, file a case with Splunk Support to have them generate a new certificate.
2. After Splunk Support advises you that the new certificate is ready, download the service provider metadata file for your Splunk Cloud Platform instance by visiting the following URL: http://<name of your Splunk Cloud Platform instance>.splunkcloud.com/en_US/saml/spmetadata
   

   The name of your Splunk Cloud Platform instance appears in the welcome letter you received after you signed up for Splunk Cloud Platform. If you don't have this letter, contact Splunk Support and they can provide this information to you.

3. After you download the SPMetadata.xml service provider metadata file, use a text editor to open this file.
4. Search the file for the following tag: <ds:X509Certificate>
5. Select all of the text between that tag and the closing tag </ds:X509Certificate> later in the file.
6. Copy this selected text to your computer's clipboard.
7. With the same text editor, open a new text file.
8. Paste the information you copied between the previously-specified tags. This is the updated Splunk Cloud Platform SAML certificate that Splunk Support created for you.
9. Insert the following string as the first line of the file: -----BEGIN CERTIFICATE-----. Confirm that there are no spaces between this line and the certificate text.
10. Insert the following string as the last line of the file: -----END CERTIFICATE-----. Confirm that there are no spaces between the certificate text and this line.
11. Save this file as a certificate file with a .pem extension. The filename must end in .pem, as .txt or any other extension is not acceptable.
12. Log into your identity provider and access its configuration page.
13. Upload the SCP SAML certificate to your IdP. The field or control that you use to upload the certificate depends on the IdP you use. For example, if you use Okta, you upload the certificate using the Signature Certificate upload control on the Okta configuration page.
14. Where applicable, save your IdP configuration and exit the IdP configuration page.

Adjust the certificate expiration warning thresholds and notification intervals

You can control when the Splunk Platform notifies you of impending expiration of an identity provider certificate and how often you receive those expiration warnings. The following settings control these elements and you can use a REST API call to change them at any time:

curl -u <user>:<password> https://<hostname>:<management_port>/services/admin/SAML-auth/saml -d <setting=value> [-d <setting=value>]

The settings for controlling thresholds and intervals follow:

Setting name	Description	Default
idpCertExpirationWarningDays	The number of days before an identity provider certificate expires. During this period, when a SAML login occurs, the Splunk platform generates a certificate expiration warning log.	90
IdPCertExpirationCheckInterval	How long a Splunk platform instance must wait, after generating a certificate expiration warning log after a login, to generate another one. You can specify this interval in <integer>[m|h|d], where m = minutes, h = hours, or d = days.	1d