topic Re: Azure AD integration with Splunk in Splunk Enterprise

Azure AD integration with Splunk

sivakrishna — Wed, 05 Jun 2024 13:44:41 GMT

Hello Team,

We tried to integrate our Splunk enterprise LB URL using SAML authentication. We gave details such as Entity ID, LB URL, and Reply URL, and they generated metadata (XML), which we then uploaded to Splunk. After configuration, we received the following error.

Please find the below SS error FYR.

Could you please assist us with the mentioned integration part
Please let us know if you need any other information.

Regards,
Siva.

Re: Azure AD integration with Splunk

kiran_panchavat — Wed, 05 Jun 2024 16:37:42 GMT

@sivakrishna Hello Siva, Refer the below documents

https://community.splunk.com/t5/Security/Why-does-Saml-response-not-contain-group-information/m-p/417492

https://community.splunk.com/t5/Security/quot-Saml-response-does-not-contain-group-information-quot-SSO/m-p/484498

Re: Azure AD integration with Splunk

Pratyush — Wed, 05 Jun 2024 17:08:22 GMT

@sivakrishnaHave you assigned the user to a group in Azure AD and mapped that group to a role in Splunk?

Re: Azure AD integration with Splunk

sivakrishna — Thu, 06 Jun 2024 05:30:35 GMT

Hi @Pratyush,

yes, Azure team has assigned a user to the groups they have created, and we have mapped that group with Splunk