10/5/2023 0 Comments Splunk login urlUsing a web browser, go to the IP address you assigned to Splunk Phantom.Perform the following tasks to log in to the Splunk Phantom web interface after installation is complete. For Okta set it to "0" (Zero).Log in to the Splunk Phantom web interface Provide a redirect port for the load balancer described in the previous field. You must provide an address if you use load balancing with a search head cluster. This setting works for a Splunk deployment with Single Search Head Setup or a Search Head Cluster Setup. įQDN - Host Name or IP of the load balancer This value maps the alias to the user email addresses in the SAML response returned. Populate this field if you use Azure AD as your IdP. This value tells Splunk Enterprise where to map the real name in the SAML response returned. If you have configured Azure AD, specify. This value tells Splunk the attribute that contains the role information in the SAML response returned. If you have configured the AD FS built-in "Role" attribute to be returned and this has the AD group information, specify. Use this field to specify a new attribute name on any IdP and then configure an alias on the Splunk side for any of the 3 attributes. In Advanced settings, provide the following information.This field is the endpoint on the IdP to which queries over SOAP are sent. These fields are not required for creating scheduled searches with Okta, Azure AD, or AD FS. If you use PingIdentity as your IdP, in Attribute Query, provide the following information so you can create scheduled searches later.This field is the entity ID as configured in the SP connection entry in your IdP. When configuring SAML on a search head cluster, make sure you configure the same certificate for each search head. If you provide a directory, Splunk looks for all the certificates that are present as children of the directory and tries to validate SAML response with each one of them, if Splunk fails to validate authenticity with all of them, response is not considered authentic. If you provide a file, Splunk uses that file to validate authenticity of SAML response. This value can be a directory or a file, depending on your IdP requirements. If you do not provide this URL, the user will not be logged out. This field is populated automatically by the metadata file and is the IdP protocol endpoint. Users can also log into their local Splunk account by navigating directly to splunkweb:port/en-US/account/login?loginType=Splunk To access the login page once SAML is enabled, append the full login URL ( /account/login) with loginType=Splunk. It is the protected endpoint on your IdP to which Splunk sends authentication requests. This field is populated automatically by your selected metadata file. In General Settings, provide the following information.This does not mean that your IdP is incompatible with the Splunk platform. If you receive an error message that the Splunk platform is unable to process the payload received when you upload or paste your IdP metadata file, then you must manually provide all of the IdP information, as described in the rest of this procedure. Refer to your IdP's documentation if you are not sure how to get your metadata file. Browse and select your metadata file, or copy and paste your metadata directly into the text window.On the SAML Groups page, click SAML Configuration.Select SAML as your authentication type.In the Settings menu, select Authentication method.Verify that your system meets all of the requirements. It encrypts the entire SAML assertion.įor information about supported and tested IdPs, see Configure single sign-on with SAML. The Splunk platform does not support the encryption of individual SAML attributes. In this case, you will need to put in IdP configuration parameters manually.Īfter you configure the Splunk platform to use your SAML authentication system, you can authorize groups on your IdP to log in by mapping them to Splunk user roles. While the Splunk platform supports a number of IdP metadata file formats, it might not be able to read through part or all of your specific metadata file. You can upload a metadata file from your IdP to populate some of the fields that appear in this procedure. For assistance with configuration procedures that are not documented in this chapter, contact Splunk Support. There might be exceptions or differences in the process of configuring an IdP to work with the platform, depending upon the IdP you use. Use this topic for general configuration instructions to connect an IdP with the Splunk platform. You can configure the Splunk platform to use any identity provider that is compliant with version 2.0 of the Security Assertion Markup Language (SAML) for single sign-on operations.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |