Did you have SAML issues after upgrading from 7.3.2 to 7.3.3?

[lycollicott]

I admittedly haven’t done a lot of digging yet, because I successfully rolled back the upgrade (which is great because it’s Friday evening and I don’t want to work all night).

I got “Malformed SAML document (assertions) received “ when I tried to login after the patch.

Anyone else have a similar experience?

[richgalloway · Accepted solution]

This is a Known Issue. See https://docs.splunk.com/Documentation/Splunk/7.3.3/ReleaseNotes/Knownissues

Splunk does not support the use of SAML authentication with unsigned assertions in this release.

If you set signedAssertion = false in authentication.conf or leave the "Verify SAML response" option unchecked in the SAML configuration page in Splunk Web, SAML logins fail. The use of unsigned assertions is not an appropriate best practice for production environments.

Follow the "SAML SSO best practices" guide in the Securing Splunk Enterprise Manual by properly configuring the identity provider (IdP) certificate chain and enforcing SAML response validation by either setting signedAssertion = true in authentication.conf or by checking the "Verify SAML response" option in Splunk Web.

[james_arq]

Yes, I upgraded from 7.3.1 to 7.3.3 and now my search head's unusable. It seem like they've changed major parts of the SSL config again... 😞

[cdaniel77]

I had the exact same experience. I have rolled back and am actively reviewing next steps.