Configure an ADFS SSO integration đź”—
The Microsoft Active Directory Federation Services (ADFS) SSO integration lets your users log in to Splunk Observability Cloud using your Microsoft ADFS portal.
Before you begin configuring the ADFS integration, ensure you have completed the steps in Configure SSO integrations for Splunk Observability Cloud, including the section Name an SSO integration to learn about naming your integrations.
This integration is only available for Microsoft Entra ID (formerly Azure Active Directory) with ADFS. In addition, you need to have the following fields in your ADFS configuration:
First Name
Last Name
Email
The procedure for configuring ADFS with Splunk Observability Cloud has these sections:
Create a new ADFS SSO integration in Splunk Observability Cloud
Obtain ADFS certificate to install to Splunk Observability Cloud
Obtain federation metadata file to install to Splunk Observability Cloud
Upload the ADFS certificate and federation metadata to Splunk Observability Cloud
Send your domain information to Splunk Support đź”—
Your users can’t authenticate using an ADFS SSO integration until Splunk activates it. To request the activation, contact Splunk Observability Cloud support.
Be ready to provide your login email domain. For example, if your users log in to SSO with user IDs like kai@example.com, then example.com is the login email domain.
After support activates the integration, users can authenticate using ADFS SSO.
Create a new ADFS SSO integration in Splunk Observability Cloud đź”—
To create a new ADFS integration in Splunk Observability Cloud:
Log in to Splunk Observability Cloud.
Open the ADFS guided setup . Optionally, you can navigate to the guided setup on your own:
In the left navigation menu, select .
Go to the Available integrations tab, or select Add Integration in the Deployed integrations tab.
In the integration filter menu, select All.
In the Search field, search for Active Directory FS, and select it.
In the Name field, enter a name for your ADFS SSO integration.
Save the Integration ID field value to a file. You’ll need this value in a subsequent step.
- If you want to set up ADFS to integrate with multiple organizations:
Select Integration-specific Entity ID.
Save the URI displayed next to the check box. You’ll need it in a subsequent step to configure ADFS. To learn more, see Integrate an identity provider with multiple organizations.
Keep this page open. You’ll upload the Certificate and Metadata files in a subsequent step.
Add Splunk Observability Cloud to ADFS đź”—
Add Splunk Observability Cloud as a relying party in ADFS:
In separate browser tab or window, log in to the ADFS server and open the ADFS management console.
In the console, right-click on Relying Party Trusts, select , then select Start.
Select , then select Next.
Select , then select Next.
For Display name, enter Splunk Observability Cloud, then select Next.
On the screen that appears, leave the default certificate settings unchanged.
On the Configure URL page, leave the two options deselected and select Next.
On the Configure Identifiers page, enter your entity ID in the Relying party trust identifiers text box:
If you’re setting up multiple integrations for ADFS, enter the integration-specific entity ID you obtained previously.
If you’re using a single integration for ADFS, enter one of these entity IDs, depending on the realm you’re in:
If your organization uses realm
us0, enter the following:https://api.signalfx.com/v1/saml/metadataIf your organization uses another realm, enter the following:
https://api.<YOUR_REALM>.signalfx.com/v1/saml/metadata
To learn more about realms, see Note about realms.
Select Add, then select Next.
The next step in the guided setup lets you configure multifactor authentication. Because Splunk Observability Cloud doesn’t require this option, select Next.
On the Choose access control policy page, do the following:
Select .
Optionally, you can select I do not want to configure access control policies at this time In a later step, you can add authorization rules. Adding rules isn’t part of the integration procedure, so it’s not described here.
Select Next.
Review your settings, and then select Next.
On the Ready to Add Trust page, select Next.
On the Finish page, deselect Configure claims issuance policy for this application, then select Close.
On the page that appears, select , right-click Splunk Observability Cloud, then select .
Select the Advanced tab, then from the Secure Hash Algorithm list, select .
Select the Endpoints tab, then select Add SAML… In the dialog box, do the following:
From the Endpoint type list, select SAML Assertion Consumer.
From the Binding list, select POST.
Select Set the trusted URL as default.
For Trusted URL, enter the URL, replacing
<INTEGRATION_ID>with the integration ID you copied in step 3 of the section Create a new ADFS SSO integration in Splunk Observability Cloud:If your organization is in realm
us0, enter the following:
https://api.signalfx.com/v1/saml/acs/<INTEGRATION_ID>If your organization is in another realm, enter the following:
https://api.<YOUR_REALM>.signalfx.com/v1/saml/acs/<INTEGRATION_ID>To learn more about realms, see Note about realms.
Select OK to close the Add an endpoint dialog box.
Select OK to close the Splunk Observability Cloud Properties dialog box.
On the page that appears, select Relying Party Trusts and right-click on Splunk Observability Cloud.
From the Claim rule policy list, select .
Select Add Rule….
Select , and then select Next.
Enter a name for the claim rule, such as “LDAP”, then from the Attribute store list, select Microsoft Entra ID.
In the Mapping of LDAP attributes to outgoing claim types pane, use the drop-down lists to set the mappings between the LDAP Attribute and Outgoing Claim Type columns:
E-Mail-Addresses (email address LDAP attribute): User.email
Given-Name (First Name LDAP attribute): User.FirstName
Surname (Last Name LDAP attribute): User.LastName
SAM-Account-Name (unique user identifier LDAP attribute): PersonImmutableID.
Select Add rule… again, then select Transform an incoming claim.
Enter a name for the claim rule, such as “Email to name ID”.
Configure this rule to pass through Name ID, if it’s not already provided by your ADFS or SAML implementation.
For example, if you want to pass through
User.emailas the Name ID, do the following:From the Incoming claim type drop-down list, select User.email.
From the Outgoing claim type drop-down list, select Name ID.
Regardless of the types you choose, from the Outgoing name ID format drop-down list, select Persistent Identifier.
Select Finish.
Obtain ADFS certificate to install to Splunk Observability Cloud đź”—
Obtain an ADFS certificate to install to Splunk Observability Cloud:
In the ADFS management console, select Service, then select Certificates.
From the Token-signing list, right-click the certificate, then select .
Select Detail, then select Copy to file. The certificate export wizard appears.
Select , then select .
Enter certificate.cer, then select Finish.
Convert the certificate from a .cer format to a .pem format, using the
openssltool:openssl x509 -inform der -in certificate.cer -out certificate.pemIn a following step, you upload this file to Splunk Observability Cloud.
Obtain federation metadata file to install to Splunk Observability Cloud đź”—
Obtain a federation metadata file to install to Splunk Observability Cloud:
In the ADFS management console, navigate to Endpoints.
Locate the Federation Metadata endpoint and copy the URL that appears. It’s similar to the following:
https://<YOUR_SERVER_IP>/FederationMetadata/2007-06/FederationMetadata.xml.Open a new browser window or tab, then navigate to the URL you copied. This opens a file download dialog box.
Save the file FederationMetadata.xml. In a following step, you upload this file to Splunk Observability Cloud.
Note
URLs must belong to ADFS in order to validate. Accepted domains include windows.net and windows-ppe.net.
Upload the ADFS certificate and federation metadata to Splunk Observability Cloud đź”—
In Splunk Observability Cloud, do the following:
Find the ADFS page you opened in a previous step.
Select the Upload File link in the Certificate field and upload the
certificate.pemfile.Select the Upload File link in the Metadata field and upload the
FederationMetadata.xmlfile.Select Save.
The ADFS SSO integration is now available to users in your ADFS organization. When users log in to Splunk Observability Cloud from ADFS for the first time, they receive an email containing a link that they must open in order to authenticate. This only occurs the first time the user signs in. Subsequent login attempts don’t require validation.
If you want to turn off the email authentication feature, contact Splunk Observability Cloud support.
Note
The ADFS portal is the only way that your users can log in to Splunk Observability Cloud.
If you are a Splunk Observability Cloud customer and are not able to see your data in Splunk Observability Cloud, you can get help in the following ways.
Available to Splunk Observability Cloud customers
Submit a case in the Splunk Support Portal .
Contact Splunk Support .
Available to prospective customers and free trial users
Ask a question and get answers through community support at Splunk Answers .
Join the Splunk #observability user group Slack channel to communicate with customers, partners, and Splunk employees worldwide. To join, see Chat groups in the Get Started with Splunk Community manual.