Change SAML authentication to use "samAccountName" when switching from ADFS to Entra ID

Applicability

Description

After switching SAML configurations from ADFS to EntraID, Splunk is creating new users with an email format and not authenticating with the users set before the migration.

This will cause to not be able to access user configurations and knowledge objects as it is not accessing with the correct user and rather creating a new one.

Investigation

When using SAML with ADFS, is possible to check in the SAML response that the samAccountName value is used in the Name ID value:

<NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">user</NameID>

After switching the SAML configuration to use Entra ID following the Microsoft documentation (Microsoft Entra SSO integration for Splunk Enterprise), the SAML response shows the UserPrincipalName as the NameID:

<NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">user@email.com</NameID>

This will cause Splunk to create a new user/account as Splunk can't match the values with the previous ADFS user.

Resolution

The change of the value will need to be made in the Azure Side by following the steps provided in the Microsoft documentation (Customize SAML token claims):

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Browse to Identity > Applications > Enterprise applications > All applications.
3. Select the application, select Single sign-on in the left-hand menu, and then select Edit in the Attributes & Claims section.
4. Open the Name identifier value page.
5. Change the "Unique User Identifier (Name ID)" to "user.onpremisessamaccountname"
6. From the Choose name identifier format dropdown, select "Persistent"

In the Splunk side, change the following value in "authenticaton.conf":

nameIdFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

Related Links

• Microsoft Entra SSO integration with Microsoft Entra SSO for Splunk Enterprise and Splunk Cloud
• Customize SAML token claims