SiteMinder - SAML authentication failing with "No valid Splunk role found in local mapping"

Applicability

Description

New user accounts are getting the error below when trying to login into Splunk Cloud Search Head:

No valid Splunk role found in local mapping.

Investigation

In the Search Head, verify the username and the roles assigned to it under Settings > Users.

Verify the roles assigned to the user are correctly mapped to the SAML groups under Settings > Authentication methods > Configure Splunk to use SAML > SAML Groups.

Enable DEBUG for the following SAML log channels in the Search Head under Settings > Server Settings > Server logging:
Saml, UiSAML, UserManager, UserManagerPro.

Have the user account try to login into the Search Head after the DEBUG logs are enabled.

Run the following internal search in the Search Head:

index=_internal host=sh*  saml user=<user_name> component!=UserManagerPro

Information like the one should be available:

DEBUG UiSAML [2409253 webui] - Saml About to validate user roles for user=<user_name>, groups=a;list;of;groups;separated;by;semicolon

Verify if the SAML groups mapped in Splunk to the specific user is part of the list of groups.

If a long list of groups is returned but it does not contain the Splunk SAML groups, engage with SiteMinder support to verify how it is sending the list of groups' information to Splunk, if all the available user groups that are assigned to the user account.

Resolution

The IdP needs to be configured to send only the specific user groups needed by Splunk and not a list of all available user groups that are assigned to the user.

Related Links

Broadcom Community post - Send only subset of the groups in the SAML assertions