Trying to get Splunk to work with a CA Siteminder federation endpoint, why am I getting SAML authentication error "Failed to decode response from IDP"

[abrice]

I'm trying to get splunk to work with a CA Siteminder federation endpoint. I finally figured out where the assertion consumer resource URL is (they really need to update their docs on SAML integration...), but am now getting the error "Failed to decode response from IDP". Debug logs on Splunk are showing "SAML - Failed to decode" followed by the signed SAML token.

The config has the signing cert listed and is a SHA2 cert chained to Symantec's SHA2 root CA. I don't have at this point Splunk signing the AuthN request and on the IDP side I'm not requiring it. The only thing I can think of is I need to insert Symantec's SHA2 signed root into a cert store used by Splunk, maybe it's not trusted? Firefox doesn't seem to know about it as well which is why I was going down that path, however the underlying OS (Windows 2012R2) trusts the cert.

Any ideas?

[rdimri_splunk]

Okay there may be two problems here. (or 3)
1) Base64 decoding for the response is failing for some reason.
2) There could be some cert related issues.
3) Maybe the response is encrypted.

To rule out 1 I would recommend, to disable signature verification on splunk's end.
you already have a way to figure out 2, in your description.

I would also suggest checking if the response is encrypted. We dont support encrypted responses.
Let us know how it goes.

[bohanlon_splunk]

CA Siteminder is now supported as of version 6.5.1:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/ConfigureSSOinCA

[khourihan_splun]

CA Siteminder is not presently supported but is on the roadmap for a future release.