I'm trying to get splunk to work with a CA Siteminder federation endpoint. I finally figured out where the assertion consumer resource URL is (they really need to update their docs on SAML integration...), but am now getting the error "Failed to decode response from IDP". Debug logs on Splunk are showing "SAML - Failed to decode" followed by the signed SAML token.
The config has the signing cert listed and is a SHA2 cert chained to Symantec's SHA2 root CA. I don't have at this point Splunk signing the AuthN request and on the IDP side I'm not requiring it. The only thing I can think of is I need to insert Symantec's SHA2 signed root into a cert store used by Splunk, maybe it's not trusted? Firefox doesn't seem to know about it as well which is why I was going down that path, however the underlying OS (Windows 2012R2) trusts the cert.
Any ideas?
... View more