Onelogin SAML setup error: What is the other custom parameter needed for SAML to work?

[dmedlinger]

We've configured our Splunk instance using the metadata file from Onelogin and also added the ?loginType=Splunk to our login URL but now we are hitting a new error: Saml response does not contain group information.

In our Onelogin application for Splunk I've added a custom Parameter for Role in order to get around the initial error of "The 'role' field is missing in the saml response from the IdP. Fix the configuration in the IdP to include 'role' in the saml response to complete login successfully."

Would someone happen to know the other custom Parameter we need to create in order to allow for SAML to work?

[suarezry]

Have you created a role in splunk called 'test'? Also, the default role attribute is 'role'. I'm not sure if it's case sensitive. Try adding this in your $splunk_home/etc/system/local/authentication.conf:

[authenticationResponseAttrMap_SAML]
realName = FullName
role = Role

Also, where is your email in your attribute statement?

[dmedlinger]

        <saml:Attribute Name="Group"
                        NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                        >
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                 xsi:type="xs:string"
                                 >test</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute Name="FullName"
                        NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                        >
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                 xsi:type="xs:string"
                                 >Test Name</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute Name="Role"
                        NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                        >
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                 xsi:type="xs:string"
                                 >test</saml:AttributeValue>
        </saml:Attribute>
    </saml:AttributeStatement>

Here's a copy of the Attribute Statment section if it helps!