Configure Splunk SSO with Auth0 as your identity provider

LinkedIn0

I had to work on Splunk SSO Integration and since had never touched SSO/SAML before, I wanted to play with it a little bit on my machine. I’ve decided to use Oath0 as my IdP

This tutorial is based on SAML SSO with Auth0 as Service Provider and as an Identity Provider, but the steps that are relevant to configuring an Auth0 tenant as the Service Provider (SP) are replaced with Splunk Configuration.

Set up the Auth0 IDP

In this section you will configure one Auth0 tenant (tenant 2) to serve as an Identity Provider. You will do this by registering an application, but in this case, the ‘application’ you register is really a representation of tenant 1, the SAML Service Provider.

In the Auth0 dashboard:

  1. Click on “Applications” link at left.
  2. Click on the red “+ CREATE APPLICATION” button on the right.

  1. In the Name field, enter a name (I’ve had mine as “Splunk 7.0.3 Container”).
  2. Press the blue “SAVE” button.
  3. Click on the “Settings” tab.
  4. Scroll down and click on the “Show Advanced Settings” link.
  5. In the expanded window, scroll down to the “Certificates” section and click on the “DOWNLOAD CERTIFICATE” link and select PEM from the dropdown, to download a PEM-formatted certificate. The certificate will be downloaded to a file called “YOUR_TENANT.pem”. Save this file as you will need to upload this file when configuring the other Auth0 tenant, tenant 1.

  1. Click on the “Endpoints” tab and go to the “SAML” section.. Follow the “SAML Metadata URL” to download the IdP metadata file which we will need later in Splunk SAML configuration.
  2. Click on the “Endpoints” tab and go to the “SAML” section. Copy the entire contents of the “SAML Protocol URL” field and save it as in the next step you will need to paste it into Splunk SSO configuration .

Creating User(s) in Auth0

Next, create a user to use in testing the SAML SSO sequence. In the Auth0 dashboard:

  1. On the lefthand side, navigate to Users and Roles > Users
  2. Click on the “+ CREATE YOUR FIRST USER” button.

  1. In the Email field, enter an email for your test user. The domain name for the email should match what you enter in section 3 below. For example, if your user is john.doe@abc-example.com, you would enter that here, and then enter “abc-example.com” in step 3 below for the Email domain.
  2. Enter a password for the user
  3. For the Connection, leave it at the default value. (Username-Password-Authentication)
  4. Press the blue “SAVE” button.

Creating Roles and assigning user(s) in Auth0

Since Splunk relies on the IdP to return the user roles you will need to create at least one  new Role and assign a user to it.

  1. On the lefthand side, navigate to Users and Roles > Roles
  2. Click on the “+ CREATE ROLE” button.
Auth0 Create Role – details
  1. Once the Role is created click on “ADD USERS” button

  1. From the dropdown list select the user and click “ASSIGN“

NOTE: for Auth0 to return the groups information in SAML you will need to follow the steps in Return User Roles in Auth0.

Configure Splunk

  1. Login to Splunk
  2. Navigate to “Settings” > “Access Controls” > “Authentication Method”
  3. Under External authentication methods, select “SAML” and click the “SAML Settings” link

  1. Create the required SAML groups (and assign roles to them), so that these group names will be matched with the Auth0 role names

Splunk SAML Groups

  1. On top right corner click the “SAML Configuration” button
  2. On the right of the “Metadata XML File” click “Select File” and upload the IdP metadata file that you’ve downloaded from Auth, it will be called something like dev-1a2b3c4d-idp_au_auth0_com-metadata.xml (the first part will depend on your Auth0 t

Related posts about Splunk

LinkedIn0