Understanding and Configuring lockRoleToFullDN in Splunk Cloud SAML Authentication

Applicability

Description

Splunk supports SAML authentication, allowing role-based access control through identity providers (IdPs). The lockRoleToFullDN parameter in authentication.conf determines whether Splunk requires a full Distinguished Name (DN) when mapping SAML groups to Splunk roles.

Investigation

When lockRoleToFullDN = true (default), Splunk expects the exact full DN of a group to match the role mapping in authentication.conf.

When lockRoleToFullDN = false, Splunk allows role mapping using only the simple group name, providing flexibility when IdPs return group names without full DNs.

Example:

Scenario 1:

lockRoleToFullDN = true (Strict Mode - Full DN Required) 

If the IdP sends the group as:

CN=SplunkAdminGroup,OU=Security,DC=example,DC=com (Then, the role mapping in Splunk must use the full DN:[roleMap_SAML])
CN=SplunkAdminGroup,OU=Security,DC=example,DC=com = admin (If only SplunkAdminGroup is used in the mapping, the role will not be assigned).

Scenario 2:

lockRoleToFullDN = false (Flexible Mode - Simple Name Allowed)

If the IdP still sends:

CN=SplunkAdminGroup,OU=Security,DC=example,DC=com (Splunk allows role mapping with just the group name:[roleMap_SAML])
SplunkAdminGroup = admin (This ensures that users in the group receive the assigned role without requiring the full DN).

Resolution

To allow flexible role mapping using simple group names, set:

lockRoleToFullDN = false

This change enables users to receive assigned Splunk roles even when the IdP does not return full Distinguished Names for groups. This setting is particularly useful when SAML groups are mapped to multiple roles in Splunk. The IdP does not return full DN values. Simplified role mapping is required without strict DN enforcement.

In Splunk Cloud, raise a TO request to make 'lockRoleToFullDN = false'

Related Links

Authentication Conf