Security

Native SAML authentication with Shibboleth IdP

suarezry
Builder

I've been playing with our on-premise Splunk to try to get native SAML authentication working with our Shibboleth v3 Identity Provider. Most of the docs detail how to get this working using Splunk SSO with reverse proxy (eg. Apache).

I have finally gotten native SAML to work and will post the answer here. IMO, it's much simpler and cleaner that using the reverse proxy. Hopefully this will help others down the road...

1 Solution

suarezry
Builder

Configuration on Splunk

$SPLUNK_HOME/etc/system/local/authentication.conf

[authentication]
authSettings = saml
authType = SAML

[rolemap_SAML]
admin = splunkadmin
power = splunkPowerUser

[saml]
allowSslCompression = true
caCertFile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
entityId = https://mysplunk.myfqdn.ca
idpCertPath = idpCert.pem
idpSSOUrl = https://myidp.myfqdn.ca/idp/profile/SAML2/POST/SSO
redirectAfterLogoutToUrl = https://myidp.myfqdn.ca/idp/profile/Logout
redirectPort = 8000
signAuthnRequest = false
signedAssertion = true
sslKeysfile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2
defaultRoleIfMissing = none

[authenticationResponseAttrMap_SAML]
mail = urn:oid:0.9.2342.19200300.100.1.3
realName = urn:oid:2.5.4.3
role = urn:oid:2.5.4.12

The SP Metadata can be downloaded from https://mysplunk.myfqdn.ca:8000/saml/spmetadata. This needs to be provided to the Shibboleth IdP.

If you run into problems you can look at $SPLUNK_HOME/var/log/splunk/splunkd.log for SAML specific errors or warnings. The backdoor (to login with local username/password instead of SAML) is https://mysplunk.myfqdn.ca:8000/en-US/account/login?loginType=splunk


Configuration on the Shibboleth IdP

I had to create a new attribute for the nameid. I was able to reuse already existing attributes for role, email, and real name.

attribute-resolver.xml

    <!-- Splunk -->
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="splunk-nameid" sourceAttributeID="uid">
        <resolver:Dependency ref="ldap"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
    </resolver:AttributeDefinition>

attribute-filter.xml

    <!-- Splunk -->
    <afp:AttributeFilterPolicy id="releaseToSplunk">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
         value="https://mysplunk.myfqdn.ca" />

        <afp:AttributeRule attributeID="splunk-nameid">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="shibAuthorized">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="mail">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="cn">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

relying-party.xml

        <!-- Splunk -->
        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://mysplunk.myfqdn.ca">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

metadata-providers.xml

<MetadataProvider id="splunk-srchHeadCluster" xsi:type="FilesystemMetadataProvider"
             xmlns="urn:mace:shibboleth:2.0:metadata"
             metadataFile="/opt/shibboleth-idp/metadata/splunk-srchHeadCluster.xml" />

View solution in original post

suarezry
Builder

Configuration on Splunk

$SPLUNK_HOME/etc/system/local/authentication.conf

[authentication]
authSettings = saml
authType = SAML

[rolemap_SAML]
admin = splunkadmin
power = splunkPowerUser

[saml]
allowSslCompression = true
caCertFile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
entityId = https://mysplunk.myfqdn.ca
idpCertPath = idpCert.pem
idpSSOUrl = https://myidp.myfqdn.ca/idp/profile/SAML2/POST/SSO
redirectAfterLogoutToUrl = https://myidp.myfqdn.ca/idp/profile/Logout
redirectPort = 8000
signAuthnRequest = false
signedAssertion = true
sslKeysfile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2
defaultRoleIfMissing = none

[authenticationResponseAttrMap_SAML]
mail = urn:oid:0.9.2342.19200300.100.1.3
realName = urn:oid:2.5.4.3
role = urn:oid:2.5.4.12

The SP Metadata can be downloaded from https://mysplunk.myfqdn.ca:8000/saml/spmetadata. This needs to be provided to the Shibboleth IdP.

If you run into problems you can look at $SPLUNK_HOME/var/log/splunk/splunkd.log for SAML specific errors or warnings. The backdoor (to login with local username/password instead of SAML) is https://mysplunk.myfqdn.ca:8000/en-US/account/login?loginType=splunk


Configuration on the Shibboleth IdP

I had to create a new attribute for the nameid. I was able to reuse already existing attributes for role, email, and real name.

attribute-resolver.xml

    <!-- Splunk -->
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="splunk-nameid" sourceAttributeID="uid">
        <resolver:Dependency ref="ldap"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
    </resolver:AttributeDefinition>

attribute-filter.xml

    <!-- Splunk -->
    <afp:AttributeFilterPolicy id="releaseToSplunk">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
         value="https://mysplunk.myfqdn.ca" />

        <afp:AttributeRule attributeID="splunk-nameid">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="shibAuthorized">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="mail">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="cn">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

relying-party.xml

        <!-- Splunk -->
        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://mysplunk.myfqdn.ca">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

metadata-providers.xml

<MetadataProvider id="splunk-srchHeadCluster" xsi:type="FilesystemMetadataProvider"
             xmlns="urn:mace:shibboleth:2.0:metadata"
             metadataFile="/opt/shibboleth-idp/metadata/splunk-srchHeadCluster.xml" />
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...