topic Re: Did you have SAML issues after upgrading from 7.3.2 to 7.3.3? in Installation

Did you have SAML issues after upgrading from 7.3.2 to 7.3.3?

lycollicott — Sat, 06 Jun 2020 00:59:33 GMT

I admittedly haven’t done a lot of digging yet, because I successfully rolled back the upgrade (which is great because it’s Friday evening and I don’t want to work all night).

I got “Malformed SAML document (assertions) received “ when I tried to login after the patch.

Anyone else have a similar experience?

Re: Did you have SAML issues after upgrading from 7.3.2 to 7.3.3?

james_arq — Sat, 14 Dec 2019 12:27:11 GMT

Yes, I upgraded from 7.3.1 to 7.3.3 and now my search head's unusable. It seem like they've changed major parts of the SSL config again... 😞

Re: Did you have SAML issues after upgrading from 7.3.2 to 7.3.3?

richgalloway — Sat, 14 Dec 2019 20:18:59 GMT

This is a Known Issue. See https://docs.splunk.com/Documentation/Splunk/7.3.3/ReleaseNotes/Knownissues

Splunk does not support the use of SAML authentication with unsigned assertions in this release.

If you set signedAssertion = false in authentication.conf or leave the "Verify SAML response" option unchecked in the SAML configuration page in Splunk Web, SAML logins fail. The use of unsigned assertions is not an appropriate best practice for production environments.

Follow the "SAML SSO best practices" guide in the Securing Splunk Enterprise Manual by properly configuring the identity provider (IdP) certificate chain and enforcing SAML response validation by either setting signedAssertion = true in authentication.conf or by checking the "Verify SAML response" option in Splunk Web.

Re: Did you have SAML issues after upgrading from 7.3.2 to 7.3.3?

cdaniel77 — Mon, 16 Dec 2019 17:40:17 GMT

I had the exact same experience. I have rolled back and am actively reviewing next steps.