Configuring SAML in a search head cluster

You can configure SAML on a search head that does or does not use a load balancer. For authentication requests to be signed (recommended), you must use the same signing certificate on all search head members in the cluster.

Every search head in the cluster must have the public key of the IdP. Splunk uses this key to verify the signature of the SAML authentication response. When you use SplunkWeb to configure SAML, the public key from metadata is automatically set to replicate to Search.

1. Generate a public/private key pair.

2. Concatenate the generated key pair into one pem file. This file is used for signing authentication requests going out from Splunk. Concatenate in the following order:

• Public key is self signed:
  • Private key
  • Public key
• Public key is signed by a intermediate/rootCA:
  • Private key
  • Public key
  • Issuers of PublicKeys. Should match the order in that the certificate issuers present.
  • root CA.

3. Replicate the new certificate file to the location relative to $SPLUNK_HOME on each search head. Make sure to give the certificate the same name on all search heads. For example:

4. Edit the Splunk metadata: In the <X509Certificate> file, swap the public key in the metadata with the public key from the new certificate. Then remove the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags.

5. Configure your IdP using the Splunk metadata. See the instructions for your IdP.

6. Collect your IdP metadata and use it to configure Splunk. Previous steps created a SAML-related configuration in $SPLUNK_HOME/etc/system/local/authentication.conf.

Note: To enable seamless Single Logout, we recommend that you configure search head members to all have same entityID.

7. Add the path to the ClientCert parameter in authentication configuration:

8. If the private key you created in step 1. is encrypted and you set up a password for the private key sslPassword = <password for private key> then you must repeat steps ABC for all search head members.

9. Reload authentication on all search heads to implement your changes.

10. To validate your configuration, log in to each search head individually to ensure all search heads are using the same key for signing authentication requests and that the IdP is configured with the right cert for verifying signature of the request.