SAML users unable to login after upgrade

Applicability

Description

Following a Splunk Cloud upgrade, users configured for SAML authentication may be unable to log in.

When attempting to log in, users may see an errors similar to:

IDP failed to authenticate request. Status Code="Requester". Check splunkd.log for more information about the failure.

or

"AADSTS50011: The reply URL 'https://<instance>:8443/saml/acs' specified in the request does not match the reply URLs configured for the application 'splunk-itsi-dev'. Make sure the reply URL sent in the request matches one added to your application in the Azure portal."

Local (Splunk) accounts continue to authenticate successfully.

Investigation

Users attempting to log in through SAML receive an error indicating that the SAML configuration does not match.

You may also see errors similar to the following in the Splunk logs: 

ERROR UiSAML [2232960 webui] - IDP failed to authenticate request. Status Message="Unknown AssertionConsumerServiceURL https://stack.splunkcloud.com:8443/saml/acs" Status Code="Requester"

or 

ERROR UiSAML [69489 webui] - IDP failed to authenticate request. Status Message="Invalid request, ACS Url in request https://sh-i-xxxx:8443/saml/acs doesn't match configured ACS Url https://[stackname].splunkcloud.com/saml/acs." Status Code="Requester"

This issue is caused by the Fully Qualified Domain Names (FQDNs) and ports configured in the SAML Advanced Settings. In some cases, the FQDN may be set to a single search head host (for example, sh-i-xxxx), or a specific port may be explicitly defined, such as 8443 or 8000, instead of using the stack’s vanity URL.

Example of incorrect configuration:

• ES FQDN: https://sh-i-xxxx:8443

• AdHoc FQDN: https://sh-i-xxxx:8443

These values reference specific search head instances rather than the Splunk Cloud stack URL. As a result, the Identity Provider (IdP) does not recognize the Assertion Consumer Service (ACS) URL included in the authentication request.

Resolution

1. Navigate to Settings > Authentication Methods.

2. Select SAML.

3. Click Configure Splunk to use SAML.

4. Under Advanced Settings:

   • Update the FQDN values to use the Splunk Cloud stack vanity URLs (not individual search head hostnames).

   • Set the Port value to 0.

5. The correct URLs should resemble the following:

   AdHoc
   

   https://stackname.splunkcloud.com

   ES

   https://es-stackname.splunkcloud.com

After these settings are saved and applied, users are expected to successfully authenticate via SAML without further errors.