Security
Highlighted

Is there any way we can do SAML authentication in Splunk with ADFS as the Identity Provider?

Explorer

Is there any way we can do SAML authentication in Splunk with ADFS as IDP?
We don't need SSO using proxy authentication and using modauthmellon.?

Highlighted

Re: Is there any way we can do SAML authentication in Splunk with ADFS as the Identity Provider?

SplunkTrust
SplunkTrust

You may need to handle this with a reverse proxy enabled with SAML provider such as apache & shibboleth.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/ConfigureSplunkSSO

http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Usesinglesign-onwithSplunk

I'm assuming your splunk is based on 'nix due tot he modauthmellon comment.

Highlighted

Re: Is there any way we can do SAML authentication in Splunk with ADFS as the Identity Provider?

Communicator

I downvoted this post because splunk now supports saml natively, so there should be a way to do it in the software without a reverse proxy.

0 Karma
Highlighted

Re: Is there any way we can do SAML authentication in Splunk with ADFS as the Identity Provider?

SplunkTrust
SplunkTrust

If I could I'd downvote this downvote because they didn't give their version number in the question and then you downvoted my answer citing Splunk can do this natively in the latest version.

0 Karma
Highlighted

Re: Is there any way we can do SAML authentication in Splunk with ADFS as the Identity Provider?

Path Finder

I've played with it last weekend and got it working. Since version 6.3 Splunk support native SAML authentication.

However there are a number of caveats, one of which is to disable signing of AuthnRequest that Splunk sends to ADFS, and the other that logout doesn't seem to be working due to an "invalid SAML request". The docs mention to only provide support for PingIdentity as SAML provider for now, so your miles may vary.

See Example #5 on my Github (https://github.com/jorritfolmer/puppet-splunk) for some screenshot on how to setup the ADFS side to get SAML authentication working.

Highlighted

Re: Is there any way we can do SAML authentication in Splunk with ADFS as the Identity Provider?

Path Finder

What value did you put into the Attribute query URL field? According to the Splunk documentation, this is the identity provider endpoint where SOAP requests are to be sent. I cannot find any such URI-paths at the iis AD FS web application.

0 Karma
Highlighted

Re: Is there any way we can do SAML authentication in Splunk with ADFS as the Identity Provider?

Path Finder

I set it to some dummy value, as far as I know there is no such URL for ADFS. You don't really need one if you set additional claim rules filling the "role" field. This is enough for Splunk to put users into the admin/power/user groups.

0 Karma