Security

Is there any way we can do SAML authentication in Splunk with ADFS as the Identity Provider?

sent2020
Explorer

Is there any way we can do SAML authentication in Splunk with ADFS as IDP?
We don't need SSO using proxy authentication and using mod_auth_mellon.?

jorritf
Path Finder

I've played with it last weekend and got it working. Since version 6.3 Splunk support native SAML authentication.

However there are a number of caveats, one of which is to disable signing of AuthnRequest that Splunk sends to ADFS, and the other that logout doesn't seem to be working due to an "invalid SAML request". The docs mention to only provide support for PingIdentity as SAML provider for now, so your miles may vary.

See Example #5 on my Github (https://github.com/jorritfolmer/puppet-splunk) for some screenshot on how to setup the ADFS side to get SAML authentication working.

RubenOlsen
Path Finder

What value did you put into the Attribute query URL field? According to the Splunk documentation, this is the identity provider endpoint where SOAP requests are to be sent. I cannot find any such URI-paths at the iis AD FS web application.

0 Karma

jorritf
Path Finder

I set it to some dummy value, as far as I know there is no such URL for ADFS. You don't really need one if you set additional claim rules filling the "role" field. This is enough for Splunk to put users into the admin/power/user groups.

0 Karma

jkat54
SplunkTrust
SplunkTrust

You may need to handle this with a reverse proxy enabled with SAML provider such as apache & shibboleth.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/ConfigureSplunkSSO

http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Usesinglesign-onwithSplunk

I'm assuming your splunk is based on 'nix due tot he mod_auth_mellon comment.

delink
Communicator

I downvoted this post because splunk now supports saml natively, so there should be a way to do it in the software without a reverse proxy.

0 Karma

jkat54
SplunkTrust
SplunkTrust

If I could I'd downvote this downvote because they didn't give their version number in the question and then you downvoted my answer citing Splunk can do this natively in the latest version.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...