SAML/SSO Failed to parse issuer

New Member

I have been working to try to authenticate with SAML and have been unable to figure out why we're not able make it work.  

We have stripped all the security configs out to try to get it to start authenticating (in expectation of turning them back on later) but we seem to be stuck and missing something.

Full disclosure: This is the first time I've implemented SAML and it's the first time the SAML admin has tried to hook to Splunk.

My authentication.conf is as follows:



fqdn = <our_fqdn>
entityId = <our_id>
idpSSOUrl =
inboundSignatureAlgorithm = RSA-SHA256
issuerId = <our_issuer_id>
redirectPort = 8000
replicateCertificates = true
signAuthnRequest = false
signatureAlgorithm = RSA-SHA256
signedAssertion = false
sloBinding = HTTP-POST
ssoBinding = HTTP-POST
idpCertPath = $SPLUNK_HOME/etc/auth/idpCerts/
clientCert = $SPLUNK_HOME/etc/auth/mycerts/mycert.pem
caCertFile = $SPLUNK_HOME/etc/auth/mycerts/cacert.pem

authSettings = saml
authType = SAML

admin  = splunk_enterprise_admin




From splunkd.log:

ERROR Saml - Failed to parse issuer.  Could not evaluate xpath expression //saml:Assertion/saml:Issuer or no matching nodes found.  No value found in SAMLResponse for key=//saml:Assertion/saml:Issuer


Labels (2)
0 Karma