Native SAML authentication with Shibboleth IdP


I've been playing with our on-premise Splunk to try to get native SAML authentication working with our Shibboleth v3 Identity Provider. Most of the docs detail how to get this working using Splunk SSO with reverse proxy (eg. Apache).

I have finally gotten native SAML to work and will post the answer here. IMO, it's much simpler and cleaner that using the reverse proxy. Hopefully this will help others down the road...


Re: Native SAML authentication with Shibboleth IdP


Configuration on Splunk


authSettings = saml
authType = SAML

admin = splunkadmin
power = splunkPowerUser

allowSslCompression = true
caCertFile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
entityId =
idpCertPath = idpCert.pem
idpSSOUrl =
redirectAfterLogoutToUrl =
redirectPort = 8000
signAuthnRequest = false
signedAssertion = true
sslKeysfile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2
defaultRoleIfMissing = none

mail = urn:oid:0.9.2342.19200300.100.1.3
realName = urn:oid:
role = urn:oid:

The SP Metadata can be downloaded from This needs to be provided to the Shibboleth IdP.

If you run into problems you can look at $SPLUNK_HOME/var/log/splunk/splunkd.log for SAML specific errors or warnings. The backdoor (to login with local username/password instead of SAML) is

Configuration on the Shibboleth IdP

I had to create a new attribute for the nameid. I was able to reuse already existing attributes for role, email, and real name.


    <!-- Splunk -->
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="splunk-nameid" sourceAttributeID="uid">
        <resolver:Dependency ref="ldap"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>


    <!-- Splunk -->
    <afp:AttributeFilterPolicy id="releaseToSplunk">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
         value="" />

        <afp:AttributeRule attributeID="splunk-nameid">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        <afp:AttributeRule attributeID="shibAuthorized">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        <afp:AttributeRule attributeID="mail">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        <afp:AttributeRule attributeID="cn">
            <afp:PermitValueRule xsi:type="basic:ANY"/>


        <!-- Splunk -->
        <bean parent="RelyingPartyByName" c:relyingPartyIds="">
            <property name="profileConfigurations">
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />


<MetadataProvider id="splunk-srchHeadCluster" xsi:type="FilesystemMetadataProvider"
             metadataFile="/opt/shibboleth-idp/metadata/splunk-srchHeadCluster.xml" />

View solution in original post