Security

Trying to get Splunk to work with a CA Siteminder federation endpoint, why am I getting SAML authentication error "Failed to decode response from IDP"

abrice
Explorer

I'm trying to get splunk to work with a CA Siteminder federation endpoint. I finally figured out where the assertion consumer resource URL is (they really need to update their docs on SAML integration...), but am now getting the error "Failed to decode response from IDP". Debug logs on Splunk are showing "SAML - Failed to decode" followed by the signed SAML token.

The config has the signing cert listed and is a SHA2 cert chained to Symantec's SHA2 root CA. I don't have at this point Splunk signing the AuthN request and on the IDP side I'm not requiring it. The only thing I can think of is I need to insert Symantec's SHA2 signed root into a cert store used by Splunk, maybe it's not trusted? Firefox doesn't seem to know about it as well which is why I was going down that path, however the underlying OS (Windows 2012R2) trusts the cert.

Any ideas?

rdimri_splunk
Splunk Employee
Splunk Employee

Okay there may be two problems here. (or 3)
1) Base64 decoding for the response is failing for some reason.
2) There could be some cert related issues.
3) Maybe the response is encrypted.

To rule out 1 I would recommend, to disable signature verification on splunk's end.
you already have a way to figure out 2, in your description.

I would also suggest checking if the response is encrypted. We dont support encrypted responses.
Let us know how it goes.

bohanlon_splunk
Splunk Employee
Splunk Employee

CA Siteminder is now supported as of version 6.5.1:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/ConfigureSSOinCA

0 Karma

khourihan_splun
Splunk Employee
Splunk Employee

CA Siteminder is not presently supported but is on the roadmap for a future release.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...