topic Splunk Search Head Integration with SAML in Deployment Architecture

Splunk Search Head Integration with SAML

keishamtcs — Sat, 06 Jun 2020 21:19:12 GMT

Hi All,

I have 4 SH cluster members for which i have to integrate SAML. Our AD team is asking the below information reply URL.

Do i need to give all the 4 url ?
Also do i need to configure the SAML on all 4 SH UI ? please do share your thoughts.

SAML-based Sign-on Attributes Value -

Reply URL (Assertion Consumer Service URL)

https://searchhead1.group.com/saml/acs
https://searchhead2.group.com/saml/acs
https://searchhead3.group.com/saml/acs
https://searchhead4.group.com/saml/acs

Re: Splunk Search Head Integration with SAML

richgalloway — Thu, 28 May 2020 20:19:35 GMT

I don't have an answer for the Reply URL, but yes, you need to configure SAML on all SHs. Don't use the UI, however, push an app from your deployer.

Re: Splunk Search Head Integration with SAML

keishamtcs — Fri, 29 May 2020 08:10:51 GMT

Thanks..can you please give some pointer on how to use as an app for the SAML config?

Re: Splunk Search Head Integration with SAML

richgalloway — Wed, 30 Sep 2020 05:33:01 GMT

Perhaps the easiest way is first to configure SAML on your deployer. Then copy the $SPLUNK_HOME/etc/system/local/authentication.conf file to $SPLUNK_HOME/etc/shcluster/apps/org_SAML_auth/default. Use the splunk apply shcluster-bundle command to send the app to SHC members. After that is done you can turn off SAML on the deployer, if you wish.