Splunk Cloud Platform

Securing Splunk Cloud Platform

Configure SAML SSO for other IdPs

You can configure the Splunk platform to use any identity provider that is compliant with version 2.0 of the Security Assertion Markup Language (SAML) protocol for single sign-on operations.

Use this topic for general configuration instructions to connect an IdP with the Splunk platform. There might be exceptions or differences in the process of configuring an IdP to work with the platform, depending upon the IdP you use.

You can upload a metadata file from your IdP to populate some of the fields that appear in this procedure. While the Splunk platform supports a number of IdP metadata file formats, it might not be able to read through part or all of your specific metadata file. In this case, you will need to put in IdP configuration parameters manually.

After you configure the Splunk platform to use your SAML authentication system, you can authorize groups on your IdP to log in by mapping them to Splunk user roles.

The Splunk platform does not support the encryption of individual SAML attributes. It encrypts the entire SAML assertion.

Get help connecting the Splunk platform to other SAML IdPs

While it is possible to connect the Splunk platform to any SAML 2.0-compliant IdP, Splunk offers direct support only for IdPs it has tested and for which instructions appear in this chapter.


Before attempting to configure the Splunk platform to use a SAML IdP, verify that your system meets all of the requirements. See Configure single sign-on with SAML.

  1. In the Settings menu, select Authentication methods.
  2. Select SAML as your authentication type.
  3. Select Configure Splunk to use SAML.
  4. On the SAML Groups page, select SAML Configuration.
  5. Browse and select the metadata file from your IdP, or copy and paste the IdP metadata directly into the text window. Refer to your IdP documentation for instructions on how to get your metadata file.

    If you receive an error message that the Splunk platform is unable to process the payload received when you upload or paste your IdP metadata file, then you must manually provide all of the IdP information, as described in the rest of this procedure. This does not mean that your IdP is incompatible with the Splunk platform.

  6. In General Settings, provide the following information.
    Single Sign on URL. The metadata file that you select populates this field. It is the protected endpoint on your IdP to which Splunk sends authentication requests. Your users use this URL for single sign-on.

    To access the login page after you enable SAML, append the full login URL (/account/login) with loginType=Splunk. Users can also log into their local Splunk account by navigating directly to splunkweb:port/en-US/account/login?loginType=Splunk

    Single Log Out URL. The metadata file that you select populates this field. It is the IdP protocol endpoint. If you do not provide this URL, the Splunk platform cannot log the user out of the IdP.
    IdP's certificate path This value can be a directory or a file, depending on your IdP requirements. If you provide a file, the Splunk platform uses that file to validate authenticity of SAML responses. If you provide a directory, the Splunk platform looks for the certificates that are present as children of the directory and tries to validate SAML responses with each of them, if the Splunk platform fails to validate authenticity with all of them, it does not consider the response as authentic.

    When you configure SAML on a search head cluster, confirm that you configure the same certificates for each search head.

    Entity ID. This field is the entity ID as configured in the service provider connection entry in your IdP.
    Sign AuthRequest. Select this option.
    Sign SAML Response. Select this option.
  7. If you use PingIdentity as your IdP, in Attribute Query, provide the following information so you can create scheduled searches later. These fields are not required for creating scheduled searches with Okta, Azure AD, or AD FS.
    Attribute Query URL. This field is the endpoint on the IdP to which the Splunk platform sends queries using the Simple Object Access Protocol (SOAP)t. The format is as follows: <urn:oasis:names:tc:SAML:2.0:attrname-format:uri>
    Sign attribute query request Select this option.
    Sign attribute query response Select this option.
  8. In Advanced settings, provide the following information.
    Attribute Alias Role Use this field to specify a new attribute name on any IdP and then configure an alias on the Splunk platform side for any of the 3 attributes.

    If you have configured the AD FS built-in "Role" attribute to be returned and this has the AD group information, specify http://schemas.microsoft.com/ws/2008/06/identity/claims/role. This value tells the Splunk platform the attribute that contains the role information in the SAML response that the IdP returns.

    If you have configured Azure AD, specify http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.

    Attribute Alias Real Name Populate this field if you use Microsoft Azure AD as your IdP. This value tells the Splunk platform where to map the real name in the SAML response that it receives. Enter http://schemas.microsoft.com/identity/claims/displayname.
    Attribute Alias Mail Populate this field if you use Azure AD as your IdP. This value maps the alias to the user email addresses in the SAML response that it receives. Enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.
    FQDN - Host Name or IP address of the load balancer What you specify depends on the setup of your Splunk platform deployment.
    (Optional) Redirect Port Provide a redirect port for the load balancer described in the previous field. For Okta, use "0" (zero).
  9. Click Save.

Next Steps

Map SAML groups to Splunk roles

Last modified on 30 November, 2023
Configure Ping Identity with leaf or intermediate SSL certificate chains   Configure authentication extensions to interface with your SAML identity provider

This documentation applies to the following versions of Splunk Cloud Platform: 8.2.2112, 8.2.2201, 8.2.2202, 9.0.2205, 8.2.2203, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308 (latest FedRAMP release), 9.1.2312, 9.2.2403

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters