Azure EntraID IdP SAML Authentication Error No valid Splunk role found in local mapping

Applicability

Description

Users receive the error message "No valid Splunk role found in local mapping" when attempting to log in to the search head via SAML authentication. This issue occurs when the Identity Provider (IdP), such as Azure EntraID in this case, sends a SAML role mapping name that is not configured within the Splunk Cloud SAML Groups. This often results from the IdP sending user.assignedroles or Object IDs instead of the expected group display names.

Investigation

The following steps should help you troubleshoot relevant errors to help address this issue: 

1. Navigate to Settings > Server settings > Log controls.
2. Set the following log channels to DEBUG: AuthenticationProviderSAML, SAMLConfigSAMLConfig, Saml, and UiSAML.
3. Attempt to log in to Splunk using the affected SAML account to reproduce the error.
4. Run the following search query to identify the SAML role mapping returned from the IdP:

index=_internal sourcetype=splunkd samlp

5. Review the events to identify the value being passed in the SAML attribute.
6. Compare the value found in the logs against the configurations in Settings > Access Controls > Authentication Method > SAML Groups.

Resolution

Since Splunk reads what Azure is sending, it has to match exactly how the SAML group that is configured in Splunk Cloud. In this case, the Object ID is being sent. The following steps should help address this issue from the Azure EntraID side. Please make sure to get approval from your Azure EntraID admins prior to complete the steps below, which will make Azure EntraID send the display name to Splunk Cloud during SAML logins. 

1. Log in to the Azure Portal.
2. Navigate to Enterprise Applications > [Splunk App Name] > Single Sign-On > Attributes & Claims.
3. Edit the group claims configuration.
4. Ensure the claim is configured to send the display name instead of the Object ID.
5. Configure user.groups under the Role claim if the current configuration (such as user.assignedroles) does not provide the expected group names.
6. In Splunk, navigate to Settings > Access Controls > Authentication Method > SAML Groups.
7. Click New Group or edit the existing group mapping.
8. Ensure the Group Name in Splunk exactly matches the string sent by Azure EntraID.
9. Assign the appropriate Splunk roles to the group and click Save.
10. Navigate to Settings > Server settings > Log controls and revert the log channels back to INFO.

Related Links

Configure Splunk Cloud Platform to use SAML for authentication tokens