Security

Does Splunk have a problem with token authentication and SAML?

ww9rivers
Contributor

Splunk seems to have a problem with authenticating a SAML user account using a token.

The purpose of using token authentication is to allow an external application to run a search and get the results. A sample script is posted on GitHub as a code gist — the script simply starts a search but does not wait for the results.

The problem is that when token authentication is used with a SAML account, it only works when that SAML user is logged in on the Splunk web GUI and while the interactive session is (still) valid.

The problem is shown in the internal log:

 

07-03-2023 19:35:53.931 +0000 ERROR Saml [795668 AttrQueryRequestExecutorWorker-0] - No status code found in SamlResponse, Not a valid status.
07-03-2023 19:35:53.901 +0000 ERROR Saml [795669 AttrQueryRequestExecutorWorker-1] - No status code found in SamlResponse, Not a valid status.

 

The theory on the failure is:

  • The token authentication works with (within) Splunk;
  • But Splunk needs to perform RBAC after authentication. So it does AQR after the authentication;
  • However, when there is no valid, live SAML session, the AQR fails.

(AQR = Attribute Query Request) -- in this case, to get the user's group memberships to map to Splunk roles.

I wonder if anyone has been able to get token authentication to work for a SAML account?

[Edit]: On the other hand, is it simply impossible to use token authentication with a SAML user account?

Labels (4)
0 Karma

even65tiQ
New Member

@ww9rivers Did you end up finding a solution for this?
We have run into the same issue. We have noticed that once the user has authenticated and the token is active that it only remains active until the "Get User Info time-to-live" timeframe that is located under Attribute Extensions in the SAML Configuration.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It kinda makes sense.

With SAML authentication you don't actually authenticate against the SP but against the IdP and then pass the assertions around. How do you expect it to work when you don't authenticate against the IdP?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...