SAML and "No valid splunk role found in local mapping"

[jlmiranda45]

We have configured Splunk 6.5.1 for SAML2 authentication using a heavily customized IdP NetIQ Access Manager 4.3.
We have reached the point where we have the message "No valid splunk role found in local mapping". We do have mappings in authorization.conf. In fact Splunk does find the roles in the SAML response but can not match them to local roles; we know it because before we renamed the role tag in SAML we had "Saml response does not contain group information".

[roleMap_SAML]
admin = cn=saieiii_monitor;saieiii_monitor;splunkadmins

In various post like this: link: https://answers.splunk.com/answers/432863/splunk-63-sso-saml-and-ping-federate.html , says this:
The format needs to include the CN="group name" *AND one or more "dc=" values that describe the local LDAP tree.*

The problem seems to be that the roles in the SAML response come like this one, with lots of CN and no DC

cn=SAIEIII_MONITOR,cn=SAIEIII,cn=Level10,cn=RoleDefs,cn=RoleConfig,cn=AppConfig,cn=MIDSUserApplicationFRAME,cn=DriverSet2,ou=IDM,ou=SERVICIOS,o=SAT

The part of the role we have to match is: SAIEIII_MONITOR . We have also tried with uppercase to no avail.

Can this be the cause of the problem? How can it be fixed?

[murikadan]

We had success with role maping with Cloudminder as IdP. There this worked for us (Splunk 6.5.3):

Attribute statement in assertion:

<ns2:AttributeStatement>
            <ns2:Attribute Name="NameID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
                <ns2:AttributeValue>MyName@company.com</ns2:AttributeValue>
            </ns2:Attribute>
            <ns2:Attribute Name="realName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
                <ns2:AttributeValue>MyName@company.com</ns2:AttributeValue>
            </ns2:Attribute>
            <ns2:Attribute Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
                <ns2:AttributeValue>MyName@company.com</ns2:AttributeValue>
            </ns2:Attribute>
            <ns2:Attribute Name="role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
                <ns2:AttributeValue>cn=Splunk User,ou=groups,ou=faas,ou=cam,o=ca</ns2:AttributeValue>
                <ns2:AttributeValue>cn=Splunk ESS User,ou=groups,ou=faas,ou=cam,o=ca</ns2:AttributeValue>
            </ns2:Attribute>
</ns2:AttributeStatement>

Corresponding authentication.conf

[roleMap_SAML]
user = splunk user
ess_user = Splunk ESS User