Security

AM ver 5.5 SAML SSO with Splunk ver 7.1: is there a way to map Splunk roles to groups?

sureshchinta
Explorer

Hello:

We currently have an LDAP based authentication scheme in Splunk Ver 7.1. We're exploring to Single Sign-On (SSO) enable Splunk using Forgerock AM ver 5.5 through Security Assertion Markup Language (SAML).

Same LDAP backend will be used either using LDAP authentication scheme or SAML. Given, following are completed:

  1. Importing IdP metadata into Splunk and choosing the same NameID used in LDAP Authentication scheme
  2. Configuring AM ver 5.5 with Splunk as SP
  3. Redirection happens to AM on invoking Splunk SP URL. The assertion is verified to contain correct username (identical to LDAP auth scheme)

Error appears as "Saml response does not contain group information." although configured authentication.conf as outlined in https://www.splunk.com/blog/2016/09/21/moving-from-ldap-to-saml-authentication.html

Why does the group information need to be passed when LDAP is a common backend? In other words, is there a way to map Splunk roles to groups?

Regards

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...