Setup Flow

Prerequisites

When you log in to Splunk via SAML authentication, user information is synced to Splunk through JIT provisioning. Therefore, complete the following two configurations in advance.

① Add a Custom Attribute to Member Information

Add a custom attribute for "Full Name" to the member information in TrustLogin. The attribute name for the custom attribute can be anything you choose.

[Configuration Example]


Please refer to the following pages for instructions on how to configure custom attributes.

Custom Attribute Setup (Individual Registration)

Custom Attribute Setup (Bulk Registration)

② Create a Group and Assign Members

Create a group to map to the Splunk role group (described later) and assign members to it.
(If you can operate using an existing group, you may use an existing group instead.)
The group name can be anything you choose.

Please refer to the following page for instructions on how to create groups and assign members.
Register a Group

[Configuration Example]

• Create a "splunk_admin" group and assign members to Splunk's "sc_admin" role
• Create a "splunk_user" group and assign members to Splunk's "user" role

As a result, when a user belonging to "splunk_admin" logs in to Splunk via SAML, the "sc_admin" role is automatically assigned. Users who do not belong to a configured group will not be able to log in to Splunk.

TrustLogin Admin Page Configuration

1. Log in to TrustLogin, open the "Admin Page > Apps" menu, and click the "Register SAML App" button in the upper right of the screen.
   
   
   
2. Register the "Application Name" and "Icon" (optional).
   
   
   
3. Note down the "Identity Provider URL" and "Issuer/Entity ID" from "Identity Provider Information", and download the "Certificate".
   
   
   
4. Configure each item in "Service Provider Settings" as follows.
   

   Value for Name ID	Select "Member" - "email" (leave as default)
   Entity ID	"Splunk-[Your Splunk subdomain]" Example: If your Splunk site URL is https://abc.splunkcloud.com/ , enter "Splunk-abc"
   Name ID Format	Select "emailAddress"
   ACS URL to Service	"[Your Splunk site URL]/saml/acs" Example: If your Splunk site URL is https://abc.splunkcloud.com/ , enter "https://abc.splunkcloud.com/saml/acs"

   
   
   
   
5. Add a row (attribute) using the "Add SAML Attribute" button in "SAML Attribute Settings" and configure it as follows.
   For the group attribute value, select the group name from the dropdown; you can add multiple groups using the "+" mark on the right.
   

   Service Provider Attribute			TrustLogin (IdP) Attribute
   Attribute Name	Attribute Type	Attribute Name		Attribute Value
   role	Unspecified	role	Group	The group name you configured
   mail	Unspecified	mail	Member	Member - Email Address
   realName	Unspecified	realName	Custom Attribute	The attribute name you configured

   
   
   
6. Save by clicking the "Register" button.

Splunk Configuration

① SAML Configuration

1. Open Splunk with an administrator account and open "Settings > Authentication Methods".
   
   
   
2. Select "SAML" as the authentication method and click "Configure Splunk to use SAML".
   
   
   
3. When the SAML configuration screen opens, configure each item as follows, and finally save by clicking the "Save" button.
   (Items not listed do not need to be changed from their default settings.)
   

   Single sign-on (SSO) URL	The "Identity Provider URL" you noted down from TrustLogin
   IdP Certificate Chain	Open the certificate downloaded from TrustLogin and paste its contents
   Issuer ID	The "Issuer/Entity ID" you noted down from TrustLogin
   Entity ID	"Splunk-[Your Splunk subdomain]" (The Entity ID configured on the TrustLogin side)
   Name ID Format	Select "Email Address"
   Fully Qualified Domain Name or Load Balancer IP	Your Splunk site URL Example: https://abc.splunkcloud.com/
   Redirect Port - Load Balancer Port	0
   SSO Binding	Select "HTTP Post"

   
   
   
   

② SAML Group Configuration

1. On the SAML groups screen, click "New Group".
   
   
   
2. Configure the group name and Splunk role, then save by clicking the "Save" button.
   Note: The group name must be identical to the group name created in TrustLogin.
   
   
   
3. In the same way, create all the groups configured in the "SAML Attribute Settings" in TrustLogin.
   

TrustLogin User Configuration

① When a User Adds the App via My Page

1. Click the "Add App" button on "My Page".
2. On the "App Registration" screen, select the custom SAML app you created, and click the "Next" button in the upper right of the screen.
3. If you want to change the "Display Name", enter it, then click the "Register" button.
4. Click the app from "My Page" or the "Browser Extension" and confirm that login is successful.

② When an Administrator Adds Members

1. Search for and click the custom SAML app you created in the "Admin Page > Apps" menu.
2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.