SAML group mapping with x-groups in Splunk

Applicability

Description

A user needed to configure SAML group mapping in Splunk using the IdP attribute x-groups. The initial configuration attempted to use unsupported settings in authentication.conf for this use case, which prevented the expected role mapping behavior.

After the correct SAML response attribute mapping was applied, the user confirmed the configuration was working as expected.

Investigation

Reviewed the configuration and compared it against the supported "authentication.conf" options for SAML attribute mapping.

Confirmed that groupAttributeName is not a documented setting for this purpose and that groupAttribute is not the supported method in the [saml] stanza for standard SAML assertion role mapping.

Identified that the supported approach is updating the below in the authentication.conf:

[authenticationResponseAttrMap_SAML]
role = x-groups

Resolution

Configured the SAML response attribute mapping using the supported setting:

Update the [authenticationResponseAttrMap_SAML] stanza in

$SPLUNK_HOME/etc/apps/system/local/collections.conf

[authenticationResponseAttrMap_SAML]
role = x-groups

If the IdP sends groups in x-groups, Splunk can use that attribute as the role source.

After that, roles can be assigned through [roleMap_SAML] or by matching existing Splunk role names. The user later connected the device to the license manager and confirmed SAML authentication worked successfully.

Related Links

Splunk Documentation - Reference.