In this blog we will recover how to setup sso in splunk? Now, You can configure Splunk software to use SAML authentication for single sign-on (SSO), using information provided by your supported identity provider (IdP).Prerequisites –

  • A running version of Splunk software OR
  • A managed deployment of Splunk Cloud. Self-service deployments of Splunk Cloud log in through the Splunk customer portal and cannot independently configure SAML SSO.
  • An admin role (Splunk Enterprise) or sc_admin role (Splunk Cloud) with the change_authentication capability. This permission level lets you enable SAML and edit authentication settings on the Splunk search head.

Steps :

1. In the Settings menu, select Access Controls > Authentication method.

2. Select SAML as your authentication type.

3.Click Configure Splunk to use SAML.

4. Create 3 AD groups named as

  • ug-splunk-admin
  • ug-splunk-power
  • ug-splunk-user

5. On the SAML Groups page, click SAML Configuration.

6. Download or browse and select your metadata file, or copy and paste your metadata directly into the text window. Refer to your IdP’s documentation if you are not sure how to get your metadata file.

7.In General Settings, provide the following information

  • Single Sign on URL : This field is populated automatically by your selected metadata file. It is the protected endpoint on your IdP to which Splunk sends authentication requests.
  • Single Log Out URL : This field is populated automatically by the metadata file and is the IdP protocol endpoint. If you do not provide this URL, the user will not be logged out.
  • IdP certificate path : This value can be a directory or a file, depending on your IdP requirements. If you provide a file, Splunk software uses that file to validate the SAML response.
  • IdP certificate chains : If you use a certificate chain, order them as follows:1. Root 2. Intermediate 3. Leaf
  • Replicate certificates : Check this to replicate your IdP certificates in a search head cluster. When configuring SAML on a search head cluster, you must use the same certificate for each search head.
  • Issuer Id :This is the Entity Id of the IdP. See your IdP documentation if you are not sure where to find this information.
  • Entity ID : This field is the entity ID as configured in the SP connection entry in your IdP.
  • Sign AuthRequest : Select this option.
  • Sign SAML Response : Select this option.

8. In Attribute Query Requests, optionally provide the following information so you can create scheduled searches later.

  • Attribute Query URL : (Optional) This is the endpoint on the IdP to which queries over SOAP are sent. The format is as follows:< urn:oasis:names:tc:SAML:2.0:attrname-format:uri >
  • Sign attribute query request : Verify that this field is selected.
  • Sign attribute query response : Verify that this field is selected.
  • Username : Enter a user name.
  • Provide a password.

9. In the Alias section optionally provide the following aliasing information:

  • Role Alias : Use this field to specify a new attribute name on any IdP and then configure an alias in your Splunk deployment for any of the three attributes.
  • Real Name Alias : You may skip this field. For ADFS you can use the displayname for the Attribute Alias Real Name.
  • Mail Alias : Skip this field.

10. click on save.

Suggestions:

1. when configuring SAML on a search head cluster, make sure you configure the same certificate for each search head.

2. an error in configuring SAML could result in user and admins being locked out of splunk Cloud. Use this link below to access the local login and revert back to None for authentication if you are locked out:
https://< name >.splunkcloud.com/en-US/account/login?loginType=splunk [replace < name > with your account name]

If you are still facing issue regarding setting up sso in splunk Feel free to Ask Doubts in the Comment Box Below and Don’t Forget to Follow us on 👍 Social Networks, happy Splunking >😉