Security

Trying to get Splunk to work with a CA Siteminder federation endpoint, why am I getting SAML authentication error "Failed to decode response from IDP"

abrice
Explorer

I'm trying to get splunk to work with a CA Siteminder federation endpoint. I finally figured out where the assertion consumer resource URL is (they really need to update their docs on SAML integration...), but am now getting the error "Failed to decode response from IDP". Debug logs on Splunk are showing "SAML - Failed to decode" followed by the signed SAML token.

The config has the signing cert listed and is a SHA2 cert chained to Symantec's SHA2 root CA. I don't have at this point Splunk signing the AuthN request and on the IDP side I'm not requiring it. The only thing I can think of is I need to insert Symantec's SHA2 signed root into a cert store used by Splunk, maybe it's not trusted? Firefox doesn't seem to know about it as well which is why I was going down that path, however the underlying OS (Windows 2012R2) trusts the cert.

Any ideas?

rdimri_splunk
Splunk Employee
Splunk Employee

Okay there may be two problems here. (or 3)
1) Base64 decoding for the response is failing for some reason.
2) There could be some cert related issues.
3) Maybe the response is encrypted.

To rule out 1 I would recommend, to disable signature verification on splunk's end.
you already have a way to figure out 2, in your description.

I would also suggest checking if the response is encrypted. We dont support encrypted responses.
Let us know how it goes.

bohanlon_splunk
Splunk Employee
Splunk Employee

CA Siteminder is now supported as of version 6.5.1:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/ConfigureSSOinCA

0 Karma

khourihan_splun
Splunk Employee
Splunk Employee

CA Siteminder is not presently supported but is on the roadmap for a future release.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...