Splunk® Enterprise

Securing the Splunk Platform

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Configure SSO with PingIdentity as your SAML identity provider

If you have use PingIdentity as your Security Assertion Markup Language (SAML) identity provider (IdP), you can follow these instructions to configure your Splunk platform instance for single sign-on.

For information about how to configure PingIdentity as an IdP, consult the PingFederate documentation.

If you configure SAML in error, this can result in the Splunk platform locking out users due to it sending invalid requests to the IdP. You can always use native Splunk Authentication to log into the instance if you encounter this problem. Use the following URL pattern to access your Splunk platform instance using native authentication:


Prerequisites for configuring the Splunk platform to use PingIdentity as a SAML identity provider

  1. Confirm that your Splunk platform instance meets all the basic requirements for using SAML as an authentication scheme. See Configure single sign-on with SAML.
  2. Confirm that you have exported a metadata file from the IdP.
  3. Confirm that the IdP session timeout and the SAML session timeout on The Splunk platform instance are the same. This ensures that both The Splunk platform and the IdP invalidate sessions simultaneously. See

Configure session timeouts with Ping Identity.


  1. Log into Splunk Web if you have not already.
  2. In the system bar, select Access Controls > Authentication method.
  3. Under External, click SAML. A link Configure Splunk to use SAML appears.
  4. Click Configure Splunk to use SAML. The SAML configuration dialog box appears.
  5. In the General Settings section of the "SAML configuration" dialog box, in the Metadata XML File area, click Select File.
  6. Locate the metadata XML file that you downloaded from your IdP.
  7. Click Apply.
  8. In the General Settings section, provide the following information:



    1. Root

    2. Intermediate

    3. Leaf

    Entity ID. This field is the entity ID as configured in the service provider (SP) connection entry in your IdP.
    Sign AuthRequest. Select this option.
    Sign SAML Response. Select this option.
  9. (Optional) In Attribute Query Requests, provide the following information so you can create scheduled searches later:
    Attribute Query URL. (Optional) This is the endpoint on the IdP to which The Splunk platform sends queries over SOAP are sent. The format is as follows: <urn:oasis:names:tc:SAML:2.0:attrname-format:uri>
    Sign attribute query request Verify that this field is selected.
    Sign attribute query response Verify that this field is selected.
    Username Enter a user name.
    Provide a password.
  10. (Optional) In the Alias section, provide the following aliasing information:
    Mail Alias Skip this field.
  11. (Optional) Provide information in the Advanced Settings section only if you need to set up load balancing or change the SAML binding. See Configure advanced settings for SSO for more information.
  12. Click Save. The Splunk platform saves your configuration

Next Steps

After you configure PingIdentity as your SAML IdP, you can now map SAML groups to Splunk roles. See Map SAML groups to Splunk roles.

Last modified on 19 September, 2020
Configure single sign-on with SAML
Configure SSO with Okta as your identity provider


Was this documentation topic helpful?



0 out of 1000 Characters