Security

Native SAML authentication with Shibboleth IdP

suarezry
Builder

I've been playing with our on-premise Splunk to try to get native SAML authentication working with our Shibboleth v3 Identity Provider. Most of the docs detail how to get this working using Splunk SSO with reverse proxy (eg. Apache).

I have finally gotten native SAML to work and will post the answer here. IMO, it's much simpler and cleaner that using the reverse proxy. Hopefully this will help others down the road...

1 Solution

suarezry
Builder

Configuration on Splunk

$SPLUNK_HOME/etc/system/local/authentication.conf

[authentication]
authSettings = saml
authType = SAML

[rolemap_SAML]
admin = splunkadmin
power = splunkPowerUser

[saml]
allowSslCompression = true
caCertFile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
entityId = https://mysplunk.myfqdn.ca
idpCertPath = idpCert.pem
idpSSOUrl = https://myidp.myfqdn.ca/idp/profile/SAML2/POST/SSO
redirectAfterLogoutToUrl = https://myidp.myfqdn.ca/idp/profile/Logout
redirectPort = 8000
signAuthnRequest = false
signedAssertion = true
sslKeysfile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2
defaultRoleIfMissing = none

[authenticationResponseAttrMap_SAML]
mail = urn:oid:0.9.2342.19200300.100.1.3
realName = urn:oid:2.5.4.3
role = urn:oid:2.5.4.12

The SP Metadata can be downloaded from https://mysplunk.myfqdn.ca:8000/saml/spmetadata. This needs to be provided to the Shibboleth IdP.

If you run into problems you can look at $SPLUNK_HOME/var/log/splunk/splunkd.log for SAML specific errors or warnings. The backdoor (to login with local username/password instead of SAML) is https://mysplunk.myfqdn.ca:8000/en-US/account/login?loginType=splunk


Configuration on the Shibboleth IdP

I had to create a new attribute for the nameid. I was able to reuse already existing attributes for role, email, and real name.

attribute-resolver.xml

    <!-- Splunk -->
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="splunk-nameid" sourceAttributeID="uid">
        <resolver:Dependency ref="ldap"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
    </resolver:AttributeDefinition>

attribute-filter.xml

    <!-- Splunk -->
    <afp:AttributeFilterPolicy id="releaseToSplunk">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
         value="https://mysplunk.myfqdn.ca" />

        <afp:AttributeRule attributeID="splunk-nameid">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="shibAuthorized">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="mail">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="cn">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

relying-party.xml

        <!-- Splunk -->
        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://mysplunk.myfqdn.ca">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

metadata-providers.xml

<MetadataProvider id="splunk-srchHeadCluster" xsi:type="FilesystemMetadataProvider"
             xmlns="urn:mace:shibboleth:2.0:metadata"
             metadataFile="/opt/shibboleth-idp/metadata/splunk-srchHeadCluster.xml" />

View solution in original post

suarezry
Builder

Configuration on Splunk

$SPLUNK_HOME/etc/system/local/authentication.conf

[authentication]
authSettings = saml
authType = SAML

[rolemap_SAML]
admin = splunkadmin
power = splunkPowerUser

[saml]
allowSslCompression = true
caCertFile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
entityId = https://mysplunk.myfqdn.ca
idpCertPath = idpCert.pem
idpSSOUrl = https://myidp.myfqdn.ca/idp/profile/SAML2/POST/SSO
redirectAfterLogoutToUrl = https://myidp.myfqdn.ca/idp/profile/Logout
redirectPort = 8000
signAuthnRequest = false
signedAssertion = true
sslKeysfile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2
defaultRoleIfMissing = none

[authenticationResponseAttrMap_SAML]
mail = urn:oid:0.9.2342.19200300.100.1.3
realName = urn:oid:2.5.4.3
role = urn:oid:2.5.4.12

The SP Metadata can be downloaded from https://mysplunk.myfqdn.ca:8000/saml/spmetadata. This needs to be provided to the Shibboleth IdP.

If you run into problems you can look at $SPLUNK_HOME/var/log/splunk/splunkd.log for SAML specific errors or warnings. The backdoor (to login with local username/password instead of SAML) is https://mysplunk.myfqdn.ca:8000/en-US/account/login?loginType=splunk


Configuration on the Shibboleth IdP

I had to create a new attribute for the nameid. I was able to reuse already existing attributes for role, email, and real name.

attribute-resolver.xml

    <!-- Splunk -->
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="splunk-nameid" sourceAttributeID="uid">
        <resolver:Dependency ref="ldap"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
    </resolver:AttributeDefinition>

attribute-filter.xml

    <!-- Splunk -->
    <afp:AttributeFilterPolicy id="releaseToSplunk">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
         value="https://mysplunk.myfqdn.ca" />

        <afp:AttributeRule attributeID="splunk-nameid">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="shibAuthorized">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="mail">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="cn">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

relying-party.xml

        <!-- Splunk -->
        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://mysplunk.myfqdn.ca">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

metadata-providers.xml

<MetadataProvider id="splunk-srchHeadCluster" xsi:type="FilesystemMetadataProvider"
             xmlns="urn:mace:shibboleth:2.0:metadata"
             metadataFile="/opt/shibboleth-idp/metadata/splunk-srchHeadCluster.xml" />
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...