Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About suarezry
suarezry
Builder
Member since:
04-23-2014
06-05-2020
Community Statistics
| Posts | 170 |
| Solutions | 19 |
| Karma Given | 84 |
| Karma Received | 80 |
| Member Since | 04-23-2014 |
Activity Feed
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 10-03-2024 06:02 PM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 08-25-2023 02:00 AM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 07-28-2023 02:17 AM
- Got Karma for Re: Login with local account with SSO Okta enabled. 06-20-2023 04:26 AM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 09-01-2022 08:58 AM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 07-26-2022 06:22 AM
- Got Karma for Re: How can I control the client's Host Name that appears in Forwarder Management?. 10-26-2021 09:36 AM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 10-18-2021 06:44 AM
- Got Karma for Native SAML authentication with Shibboleth IdP. 01-19-2021 03:41 PM
- Got Karma for Re: Splunk local account login to splunkweb when SAML authentication is enabled?. 11-15-2020 03:33 AM
- Karma Re: How to concatenate a variable number of fields? for Sukisen1981. 06-05-2020 12:50 AM
- Karma Re: Kvstore has stuck at starting stage for all the search heads in cluster. for dkolekar_splunk. 06-05-2020 12:50 AM
- Karma ODBC connector for Splunk 7.x(Cloud) for apothuri. 06-05-2020 12:50 AM
- Karma Constant re-authentication after SSO migration for tjago11. 06-05-2020 12:50 AM
- Karma Re: can't read "splunkdestinationip_withrd": no such variable for prakash007. 06-05-2020 12:50 AM
- Karma Re: can't read "splunkdestinationip_withrd": no such variable for petom. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk SAML authentication - Data Confidentiality issue. 06-05-2020 12:50 AM
- Karma Re: How to index the message trace report with local timestamp for wstarowicz. 06-05-2020 12:49 AM
- Karma How to index the message trace report with local timestamp for dwangfeng. 06-05-2020 12:49 AM
- Karma Re: SAML authentication with LDAP authorization for cboston. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 1 |
11-06-2017
11:22 AM
Is your WIP http://webportalsplunk? Can you post the metadata that is generated from this config?
Is this from the searchHead that works with SAML but does not work with Load Balancing? Is your LB F5? Do you have a session persistence on your WIP to ensure that the same client is directed to the same search head? (I'm not sure if session persistence is actually required on the load balancer,this is just what we have configured in our working environment.)
... View more
11-01-2017
11:14 AM
SAML does work on a search head cluster provided you use the same SSL certs across your search heads and that the metadata on each search head is the same. The metadata is based on your $SPLUNK_HOME/etc/system/local/authentication.conf settings.
If you are having problems with this then post your authentication.conf and I can help.
... View more
10-23-2017
08:31 AM
Siteminder is releasing the name and email attribute, but no role attribute. You need to configure Siteminder to release this information.
... View more
08-04-2017
09:48 AM
Have you created a role in splunk called 'test'? Also, the default role attribute is 'role'. I'm not sure if it's case sensitive. Try adding this in your $splunk_home/etc/system/local/authentication.conf:
[authenticationResponseAttrMap_SAML]
realName = FullName
role = Role
Also, where is your email in your attribute statement?
... View more
06-29-2017
07:16 AM
Ok...
If you have confirmed that ADFS is passing the correct role information with a browser plugin then your next step is to look at $SPLUNK_HOME/var/log/splunk/splunkd.log for any SAML related errors or warnings.
... View more
06-29-2017
07:06 AM
Ok, so your first step is to find out what role information ADFS releasing to you, to pass to splunk. Use a browser plugin to trace your saml messages:
https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/
What is the role information in the ADFS assertion?
... View more
06-28-2017
01:38 PM
I need some clarification... Are you trying to login through ADFS as user1 and your problem is that this user is not being given the app2 and app3 role in splunk?
... View more
06-19-2017
03:03 PM
Just curious, why don't you connect tableau directly to Splunk?
... View more
Where do these users need to login? If you are giving them access to just perform searches then typically you would just configure ldap authentication on the search head cluster.
... View more
05-30-2017
12:05 PM
use a browser plugin to trace your saml response:
https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/
What is your IdP passing for the role field?
... View more
05-12-2017
08:49 AM
Ok, so that is the default configuration. I don't think there would be a problem with those. Is there any transforms.conf files in any of the C:Program Files\Splunk\etc...\local directories?
... View more
05-12-2017
08:30 AM
Your error message was about host extraction. This props.conf has nothing to do with host extraction.
What is the full path to the transforms.conf you posted above?
... View more
05-12-2017
08:26 AM
What is the full path of this transforms.conf you posted?
... View more
05-12-2017
08:22 AM
Audience is typically the entityID of the Service Provider, in this case Splunk.
... View more
05-11-2017
04:26 PM
Can you please post your props.conf and transforms.conf. These will contain your regex and will be more informative for me.
... View more
05-11-2017
10:30 AM
Post your regex
... View more
05-10-2017
02:14 PM
Your first stop should be the splunkd.log file to see if it's logging the cause.
... View more
05-09-2017
08:33 AM
1 Karma
It's in your splunk SP metadata:
https://yoursplunk.yourfqdn.ca:8000/saml/spmetadata
Look for the following tag:
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://yoursplunk.yourdomain.ca/saml/acs" index="0">
... View more
Configuration on Splunk
$SPLUNK_HOME/etc/system/local/authentication.conf
[authentication]
authSettings = saml
authType = SAML
[rolemap_SAML]
admin = splunkadmin
power = splunkPowerUser
[saml]
allowSslCompression = true
caCertFile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
entityId = https://mysplunk.myfqdn.ca
idpCertPath = idpCert.pem
idpSSOUrl = https://myidp.myfqdn.ca/idp/profile/SAML2/POST/SSO
redirectAfterLogoutToUrl = https://myidp.myfqdn.ca/idp/profile/Logout
redirectPort = 8000
signAuthnRequest = false
signedAssertion = true
sslKeysfile = /opt/splunk/etc/auth/mycerts/splunk-mgmtPort.crt
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2
defaultRoleIfMissing = none
[authenticationResponseAttrMap_SAML]
mail = urn:oid:0.9.2342.19200300.100.1.3
realName = urn:oid:2.5.4.3
role = urn:oid:2.5.4.12
The SP Metadata can be downloaded from https://mysplunk.myfqdn.ca:8000/saml/spmetadata. This needs to be provided to the Shibboleth IdP.
If you run into problems you can look at $SPLUNK_HOME/var/log/splunk/splunkd.log for SAML specific errors or warnings. The backdoor (to login with local username/password instead of SAML) is https://mysplunk.myfqdn.ca:8000/en-US/account/login?loginType=splunk
Configuration on the Shibboleth IdP
I had to create a new attribute for the nameid. I was able to reuse already existing attributes for role, email, and real name.
attribute-resolver.xml
<!-- Splunk -->
<resolver:AttributeDefinition xsi:type="ad:Simple" id="splunk-nameid" sourceAttributeID="uid">
<resolver:Dependency ref="ldap"/>
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
</resolver:AttributeDefinition>
attribute-filter.xml
<!-- Splunk -->
<afp:AttributeFilterPolicy id="releaseToSplunk">
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="https://mysplunk.myfqdn.ca" />
<afp:AttributeRule attributeID="splunk-nameid">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
<afp:AttributeRule attributeID="shibAuthorized">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
<afp:AttributeRule attributeID="mail">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
<afp:AttributeRule attributeID="cn">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
</afp:AttributeFilterPolicy>
relying-party.xml
<!-- Splunk -->
<bean parent="RelyingPartyByName" c:relyingPartyIds="https://mysplunk.myfqdn.ca">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO" p:encryptAssertions="false" />
</list>
</property>
</bean>
metadata-providers.xml
<MetadataProvider id="splunk-srchHeadCluster" xsi:type="FilesystemMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata"
metadataFile="/opt/shibboleth-idp/metadata/splunk-srchHeadCluster.xml" />
... View more
04-28-2017
07:32 AM
The post says that the sysadmin disabled THP so OP's is asking if the THPdefrag option still matters. It does not.
... View more
04-28-2017
07:30 AM
1 Karma
Your sysadmin is right. He has disabled THP so the THPdefrag option does not matter:
https://access.redhat.com/solutions/46111
NOTE: Some third party application install scripts check value of above files and complain even if THP is disabled at boot time using transparent_hugepage=never, this is due to the fact when THP is disabled at boot time, the value of /sys/kernel/mm/redhat_transparent_hugepage/defrag will not be changed, however this is expected and system will never go in THP defragmentation code path when it is disabled at boot and THP defrag need not to be disabled separately.
But with that said what's the big deal? Just set the defrag to 'never' and be done with it!
... View more
04-18-2017
06:27 AM
Delete the search peer from your distributed search config (in splunk web), then add the search peer back in. Does the replication succeed after this?
... View more
04-17-2017
01:17 PM
On the stand-alone we just implemented SAML/SSO and one of the annoying pieces is that all saved objects (searches, macros, lookups, etc) are "owned" by the SAML ID # of the user who created them. Annoying that I have to then translate it to the user name but I can live with that.
Can you elaborate more on this problem? I'm not sure why you're doing manual translations. Why not have your IdP pass splunk the username as the name identifier, instead of "SAML ID #"?
More of a hassle is when our administrators want to publish something as being owned by the "admin" account. Since we can no longer sign on as that account to publish content, we have to go in and manually adjust the metadata files to change ownership. Again, hassle but at least it works.
You can still login with local splunk accounts with this URL:
https://yoursplunk.yourdomain.com:8000/en-US/account/login?loginType=splunk
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
