I have been working to try to authenticate with SAML and have been unable to figure out why we're not able make it work.
We have stripped all the security configs out to try to get it to start authenticating (in expectation of turning them back on later) but we seem to be stuck and missing something.
Full disclosure: This is the first time I've implemented SAML and it's the first time the SAML admin has tried to hook to Splunk.
My authentication.conf is as follows:
[saml]
fqdn = <our_fqdn>
entityId = <our_id>
idpSSOUrl = https://idp.address.com/idp/SSO.saml2
inboundSignatureAlgorithm = RSA-SHA256
issuerId = <our_issuer_id>
redirectPort = 8000
replicateCertificates = true
signAuthnRequest = false
signatureAlgorithm = RSA-SHA256
signedAssertion = false
sloBinding = HTTP-POST
ssoBinding = HTTP-POST
idpCertPath = $SPLUNK_HOME/etc/auth/idpCerts/
clientCert = $SPLUNK_HOME/etc/auth/mycerts/mycert.pem
caCertFile = $SPLUNK_HOME/etc/auth/mycerts/cacert.pem
[authentication]
authSettings = saml
authType = SAML
[roleMap_SAML]
admin = splunk_enterprise_admin
From splunkd.log:
ERROR Saml - Failed to parse issuer. Could not evaluate xpath expression //saml:Assertion/saml:Issuer or no matching nodes found. No value found in SAMLResponse for key=//saml:Assertion/saml:Issuer
