×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
ema67
New Member
Member since: ‎02-09-2016
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎02-09-2016
Activity Feed
View All

Re: simpleSAMLphp and Splunk 6.3: Why are we getti...

by in Security
‎02-10-2016 02:36 AM
‎02-10-2016 02:36 AM
Thanks for that, much appreciated. Indeed attributes role, realName and mail are part of the user attributes on the idP. And those are sent back to Splunk as part of the SAMLResponse parameter. Here a decode of the SAMLResponse parameter sent from the idP to Splunk : Could it be because of the Attribute format used in our implementation ? : NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Thanks for the support <saml:NameID SPNameQualifier="entityid" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:email">[email protected]</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2016-02-10T10:22:52Z" Recipient="http://splunk.exemple.org:8000/saml/acs" InResponseTo="entityid.1.1EB5E003-8144-49C4-AEB5-5AC9EB9BFF3"/> </saml:SubjectConfirmation> </saml:Subject> <saml:Conditions NotBefore="2016-02-10T10:17:22Z" NotOnOrAfter="2016-02-10T10:22:52Z"> <saml:AudienceRestriction><saml:Audience>entityid</saml:Audience> </saml:AudienceRestriction> </saml:Conditions> <saml:AuthnStatement AuthnInstant="2016-02-10T10:17:52Z" SessionNotOnOrAfter="2016-02-10T18:17:52Z" SessionIndex="_b3313f75da4f84105e36e74242315fbfeca32d442c"> <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement> <saml:AttributeStatement> <saml:Attribute Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml:AttributeValue xsi:type="xs:string">[email protected]</saml:AttributeValue></saml:Attribute> <saml:Attribute Name="realName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="xs:string">John Doe</saml:AttributeValue></saml:Attribute> <saml:Attribute Name="role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="xs:string">admin</saml:AttributeValue></saml:Attribute> </saml:AttributeStatement> </saml:Assertion> </samlp:Response> ... View more

simpleSAMLphp and Splunk 6.3: Why are we getting e...

by in Security
‎02-09-2016 05:53 AM
‎02-09-2016 05:53 AM
Hello, We are trying to have our users authenticated on our idP running simpleSAMLphp before they can have access to Splunk Apps. The authentication part is working fine, as our users get redirected and authenticated successfully on our idP, before being redirected back to Splunk for accessing the Apps. At this point, we end up with an error message: No valid Splunk role found in the local mapping or assertion Our users belong to a group named "role" on the idP, but for an unknown reason, it seems that this attribute is not taken into account by Splunk. Is there a specific format that the idP needs to use in order to pass on the attributes to Splunk? Is there simplesamlphp config file examples available? Any help would be much appreciated, Regards ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM