Trying to configure SAML using Okta on Splunk, what goes in the Attribute Alias Role?

[mattpoland]

I'm trying to configure SAML using Okta on Splunk using the docs -- /6.4.0/Security/ConfigureSSOOkta

Attribute Alias Role Use this field to specify a new attribute name on any IdP and then configure an alias on the Splunk side for any of the 3 attributes.

Does someone have an example of what goes in the Attribute Alias Role?

[pgreer_splunk]

For specifics on how to configure Okta to work with Splunk (Cloud) - there is a new blog posting out there:

See it here

[rdimri_splunk]

Splunk needs three critical pieces of information in SAML authentication response to work well with SAML.
1) realName : This is the user name that gets populated in the UI.
2) mail: the email of the user.
3) role: this information is used to map user group names to splunk roles, an example would be "developer" -> "user" (SplunkRole), "domain admin"-> "admin" (SplunkRole). We create mappings for incoming group information to splunk roles via the SAML Group map(Green button next to SAML configuration on the UI)

Attribute alias mappings provide you with flexibility to choose what you want to map these to, in the assertion that is being returned.
By default we look for saml attributes called "realName", "mail" and "role".

You may or may not need this to work, you can actually configure idp to send the required attributes with the names as 'realName', 'role' and 'mail'

In the answer posted by suarezry he is mapping 'mail' to 'urn:oid:0.9.2342.19200300.100.1.3'. And as he has mentioned an easy way to look at the authentication response is to use SAML Tracer, look at the attributes that are most suitable for that purpose and map them via attribute aliases

[suarezry]

Use a browser plugin to trace saml messages:
https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/

This will show you the names of the attributes Okta is passing to splunk. For example:

<saml2:Attribute FriendlyName="mail"
                             Name="urn:oid:0.9.2342.19200300.100.1.3"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xs:string"
                                      >myemail@mydomain.ca</saml2:AttributeValue>
            </saml2:Attribute>

In this case the name for my email attribute is urn:oid:0.9.2342.19200300.100.1.3. Yours is likely different as my IdP is not Okta.