Security

AM ver 5.5 SAML SSO with Splunk ver 7.1: is there a way to map Splunk roles to groups?

sureshchinta
Explorer

Hello:

We currently have an LDAP based authentication scheme in Splunk Ver 7.1. We're exploring to Single Sign-On (SSO) enable Splunk using Forgerock AM ver 5.5 through Security Assertion Markup Language (SAML).

Same LDAP backend will be used either using LDAP authentication scheme or SAML. Given, following are completed:

  1. Importing IdP metadata into Splunk and choosing the same NameID used in LDAP Authentication scheme
  2. Configuring AM ver 5.5 with Splunk as SP
  3. Redirection happens to AM on invoking Splunk SP URL. The assertion is verified to contain correct username (identical to LDAP auth scheme)

Error appears as "Saml response does not contain group information." although configured authentication.conf as outlined in https://www.splunk.com/blog/2016/09/21/moving-from-ldap-to-saml-authentication.html

Why does the group information need to be passed when LDAP is a common backend? In other words, is there a way to map Splunk roles to groups?

Regards

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...