Error while updating SAML IdP Certificate on Splunk Web

Applicability

Description

Generally SSO is configured with SAML IdP to access Splunk web on various deployments. There will come a time when such IdP cert is about to expire or already expired and in such cases a new IDP cert is generated and uploaded to the Splunk SAML configuration. However, when attempting to update this cert by uploading newly generated metadata.xml in SAML configuration, observed error prompts stating multiple certs are present.

"There are multiple certs,idpCertPath:idpCert.pem, must be a directory" 

Investigation

Confirm below points have been checked or tried:

• Updated X509 certificate is available but unable to update the idpCert.pem.
• Check the metadata.xml is formatted correctly. Specifically confirm how many certs are present in the metadata.xml that is being uploaded.

• Try deleting IdpCert.pem from the text box "IdP certificate path" and reload the SAML authentication configuration. In such case Splunk will use the default directory (/opt/Splunk/etc/auth/) to generate the new certs. but it generally prompts:

  "The following argument cannot be empty: idpCertPath"

Resolution

It was generally observed that the metadata.xml file containing more than one certificate is not what Splunk expects. In such case where more than one certifications are present in a single xml file that is being uploaded to the Splunk SAML configuration, the file needs to be reviewed.

Option 1:

Remove the inactive/old certificate entries from the xml file and only maintain the latest certificate. Thereafter try uploading in SAML configuration and then "Reload authentication configuration." it should successfully update the respective SAML IDP Cert.

Option 2:

Enter "./" (a dot and a slash) on the text box "IdP certificate path" to force Splunk to look into the directory instead of referring to a single idpCert.pem

Related Links

Refresh expiring SAML identity provider certificates

Microsoft Entra federation metadata - Microsoft identity platform | Microsoft Learn