Map groups on a SAML identity provider to Splunk roles

After you configure a Splunk platform deployment to use a Security Assertion Markup Language (SAML) identity provider (IdP) for authentication, you can then authorize groups on that IdP to log into the Splunk platform instance by mapping those groups to Splunk roles. You can map multiple groups on the IdP to a single Splunk role.

This is the only way to give users on your IdP access to the Splunk platform deployment. You cannot give individual users on the IdP access to the Splunk platform deployment unless you create a group on the IdP for the user, or add them to an existing group.

Prerequisites for mapping SAML groups to Splunk roles

Confirm that you have completed the following steps before you attempt to map groups on your IdP to roles on your Splunk platform deployment:

• The identity provider you have is SAML version 2.0 compliant
• You have configured your IdP to supply the necessary attributes in an assertion that it sends
• You have configured your Splunk platform deployment to use the IdP as an authentication scheme.

For more specifics on these prerequisites, see Configure single sign-on with SAML.

Considerations for mapping SAML groups to Splunk roles

Depending on the SAML IdP that you use for authentication, you might need to make following considerations to ensure that authentication through SAML works properly.

Considerations for mapping groups to Splunk roles with Microsoft Azure as the identity provider

When you map SAML groups to Splunk roles, you must map the roles to the group ID, or universally unique identifier (UUID), and not the group name, since groups can share the same name. When you map roles to the group ID, this ensures that you map the correct group to your role.

Map groups on a SAML identity provider to Splunk roles

1. In the system bar, click Settings > Authentication Methods.
2. Under External, confirm that the SAML checkbox is selected.
3. Click Configure Splunk to use SAML.
4. Click Cancel to close the SAML Configuration dialog box and show the SAML groups page.
5. Click New Group, or click Edit if you want to modify an existing SAML group.
6. If you are creating a new group, in the Group Name field, enter the name of the group. Typically, this is the name of a group on the IdP.
7. In the Splunk Roles section, choose the Splunk roles to which you want this group to map by clicking one or more of the roles in the Available item(s) column.
8. Click Save. Splunk Web saves the group and returns you to the SAML Groups page.

After you configure SAML SSO and map groups to Splunk roles, you can distribute the login URL to users on your identity provider.