topic Splunk SAML Assertion X509Certificate in Security

Splunk SAML Assertion X509Certificate

maffreitas — Fri, 24 Nov 2017 14:09:15 GMT

Hi all,

Do you know the procedure to change the SAML Assertion X509Certificate (= server.pem) for a certificate signed by a third-party?

Regards.

Re: Splunk SAML Assertion X509Certificate

suarezry — Fri, 24 Nov 2017 14:39:46 GMT

I'm not sure if you're referring to changing the certificate of your Identity Provider or your Splunk Service Provider. Take a look at the authentication.conf spec.

The settings you're looking for are idpCertPath, clientCert, and caCertFile.

Re: Splunk SAML Assertion X509Certificate

maffreitas — Fri, 24 Nov 2017 14:49:18 GMT

Thanks @suarezry, the question is regarding the Splunk Service Provider (SPmetadata.xml).

Re: Splunk SAML Assertion X509Certificate

suarezry — Fri, 24 Nov 2017 14:56:02 GMT

Great, once you change the settings in your authentication.conf you'll have to restart your Splunk instance or reload the authentication config. Then you'll need to regenerate your SPmetadata.xml and confirm that XML has the new certs. Then you'll need to pass this to your IdP.

Let me know if you have any further questions. If not, please accept this answer.