Installation

Did you have SAML issues after upgrading from 7.3.2 to 7.3.3?

lycollicott
Motivator

I admittedly haven’t done a lot of digging yet, because I successfully rolled back the upgrade (which is great because it’s Friday evening and I don’t want to work all night).

I got “Malformed SAML document (assertions) received “ when I tried to login after the patch.

Anyone else have a similar experience?

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is a Known Issue. See https://docs.splunk.com/Documentation/Splunk/7.3.3/ReleaseNotes/Knownissues

Splunk does not support the use of SAML authentication with unsigned assertions in this release.

If you set signedAssertion = false in authentication.conf or leave the "Verify SAML response" option unchecked in the SAML configuration page in Splunk Web, SAML logins fail. The use of unsigned assertions is not an appropriate best practice for production environments.

Follow the "SAML SSO best practices" guide in the Securing Splunk Enterprise Manual by properly configuring the identity provider (IdP) certificate chain and enforcing SAML response validation by either setting signedAssertion = true in authentication.conf or by checking the "Verify SAML response" option in Splunk Web.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is a Known Issue. See https://docs.splunk.com/Documentation/Splunk/7.3.3/ReleaseNotes/Knownissues

Splunk does not support the use of SAML authentication with unsigned assertions in this release.

If you set signedAssertion = false in authentication.conf or leave the "Verify SAML response" option unchecked in the SAML configuration page in Splunk Web, SAML logins fail. The use of unsigned assertions is not an appropriate best practice for production environments.

Follow the "SAML SSO best practices" guide in the Securing Splunk Enterprise Manual by properly configuring the identity provider (IdP) certificate chain and enforcing SAML response validation by either setting signedAssertion = true in authentication.conf or by checking the "Verify SAML response" option in Splunk Web.
---
If this reply helps you, Karma would be appreciated.

james_arq
New Member

Yes, I upgraded from 7.3.1 to 7.3.3 and now my search head's unusable. It seem like they've changed major parts of the SSL config again... 😞

0 Karma

cdaniel77
New Member

I had the exact same experience. I have rolled back and am actively reviewing next steps.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...