Installation

Did you have SAML issues after upgrading from 7.3.2 to 7.3.3?

lycollicott
Motivator

I admittedly haven’t done a lot of digging yet, because I successfully rolled back the upgrade (which is great because it’s Friday evening and I don’t want to work all night).

I got “Malformed SAML document (assertions) received “ when I tried to login after the patch.

Anyone else have a similar experience?

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is a Known Issue. See https://docs.splunk.com/Documentation/Splunk/7.3.3/ReleaseNotes/Knownissues

Splunk does not support the use of SAML authentication with unsigned assertions in this release.

If you set signedAssertion = false in authentication.conf or leave the "Verify SAML response" option unchecked in the SAML configuration page in Splunk Web, SAML logins fail. The use of unsigned assertions is not an appropriate best practice for production environments.

Follow the "SAML SSO best practices" guide in the Securing Splunk Enterprise Manual by properly configuring the identity provider (IdP) certificate chain and enforcing SAML response validation by either setting signedAssertion = true in authentication.conf or by checking the "Verify SAML response" option in Splunk Web.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is a Known Issue. See https://docs.splunk.com/Documentation/Splunk/7.3.3/ReleaseNotes/Knownissues

Splunk does not support the use of SAML authentication with unsigned assertions in this release.

If you set signedAssertion = false in authentication.conf or leave the "Verify SAML response" option unchecked in the SAML configuration page in Splunk Web, SAML logins fail. The use of unsigned assertions is not an appropriate best practice for production environments.

Follow the "SAML SSO best practices" guide in the Securing Splunk Enterprise Manual by properly configuring the identity provider (IdP) certificate chain and enforcing SAML response validation by either setting signedAssertion = true in authentication.conf or by checking the "Verify SAML response" option in Splunk Web.
---
If this reply helps you, Karma would be appreciated.

james_arq
New Member

Yes, I upgraded from 7.3.1 to 7.3.3 and now my search head's unusable. It seem like they've changed major parts of the SSL config again... 😞

0 Karma

cdaniel77
New Member

I had the exact same experience. I have rolled back and am actively reviewing next steps.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...