Is there any way we can do SAML authentication in Splunk with ADFS as the Identity Provider?

[sent2020]

Is there any way we can do SAML authentication in Splunk with ADFS as IDP?
We don't need SSO using proxy authentication and using mod_auth_mellon.?

[jorritf]

I've played with it last weekend and got it working. Since version 6.3 Splunk support native SAML authentication.

However there are a number of caveats, one of which is to disable signing of AuthnRequest that Splunk sends to ADFS, and the other that logout doesn't seem to be working due to an "invalid SAML request". The docs mention to only provide support for PingIdentity as SAML provider for now, so your miles may vary.

See Example #5 on my Github (https://github.com/jorritfolmer/puppet-splunk) for some screenshot on how to setup the ADFS side to get SAML authentication working.

[RubenOlsen]

What value did you put into the Attribute query URL field? According to the Splunk documentation, this is the identity provider endpoint where SOAP requests are to be sent. I cannot find any such URI-paths at the iis AD FS web application.

[jorritf]

I set it to some dummy value, as far as I know there is no such URL for ADFS. You don't really need one if you set additional claim rules filling the "role" field. This is enough for Splunk to put users into the admin/power/user groups.

[jkat54]

You may need to handle this with a reverse proxy enabled with SAML provider such as apache & shibboleth.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/ConfigureSplunkSSO

http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Usesinglesign-onwithSplunk

I'm assuming your splunk is based on 'nix due tot he mod_auth_mellon comment.

[delink]

I downvoted this post because splunk now supports saml natively, so there should be a way to do it in the software without a reverse proxy.

[jkat54]

If I could I'd downvote this downvote because they didn't give their version number in the question and then you downvoted my answer citing Splunk can do this natively in the latest version.