Configuring Google Workspace as a SAML IdP with Splunk Cloud Platform

Data required

Google Workspace

​Create a custom attribute in the Google Workspace directory

First, you'll need to create a custom attribute to manage the Splunk user role in the Google Workspace directory.

1. Click Directory, then Users, More Options, and then Manage custom attributes.

2. In the next screen, click Add Custom Attribute.

3. Configure the new custom attribute with the following parameters:

• Category
  • splunk
• Description
  • splunk
• Custom fields
  • Name
    • role
  • Info type
    • Text
  • Visibility
    • Visible to user and admin
  • No. of values
    • Multi-value

This screenshot shows an example:

Create a custom Splunk SAML application

Next, you will need to create a custom Splunk SAML application.

1. Click Apps, then Web and mobile apps, Add app, and then Add custom SAML app.

2. In the App details screen, enter an application name and description. You can also upload an icon for the application. Click Continue to proceed.

3. You can download the IdP metadata file on the next screen. Click Download Metadata and save this to a download folder. You will need this file when setting up the Splunk portion of the SAML configuration. You might want to also take a screenshot of the SSO URL, entity ID and certificate below the Download Metadata button for reference.

4. On the Service provider details screen, information about the Splunk Cloud Platform instance must be configured. Use the following values, substituting the actual URL of your Splunk Cloud Platform instance.

• ACS URL
  • https://YOUR-INSTANCE.splunkcloud.com/saml/acs
• Entity ID
  • https://YOUR-INSTANCE.splunkcloud.com/
• Start URL
  • https://YOUR-INSTANCE.splunkcloud.com/

See the following screenshot for an example. Click Continue when you have entered this information.

5. The last screen allows attribute mappings to be configured. This will control what user attributes are sent to Splunk during the SAML authentication flow. Click Add mapping to start adding attributes.

6. Add the following attribute mappings. These are case-sensitive.

Google Directory Attributes	App Attributes
First name	Name
Primary email	Email
role	role

The screenshot below shows an example set of mappings. Click Finish when you are done.

Enable the application

After configuring Splunk as a SAML application, a summary screen is displayed. Under User Access, you can see that the application is marked as "OFF for everyone."

1. Click on the words OFF for everyone. The next screen allows enabling the SAML application across the organization. Click the ON for everyone radio button and Save to proceed.

Grant users access to application

The final Google configuration step is to configure a user role.

1. Click on Directory, then Users. Next, click a username. You will be taken to a user summary page. Click User details under User information. This will take you to a new page where you can set the Splunk role.

2. Scroll down until you see the role attribute. In the example screenshot below, the role has been set to "user". This role must map to a local role on the Splunk Cloud Platform instance.

Configure Splunk SAML settings

Once the Google Workspace portion has been configured, you are ready to configure the Splunk SAML settings.

1. Log in to Splunk as an administrator.

2. Click Settings, then Users and Authentication and then Authentication Methods. Choose the SAML radio button next to External. Click the SAML Settings link to proceed to the Identity Provider setup screen.

3. On the SAML Configuration screen, click Select File next to Metadata XML File. Find the GoogleIDPMetadata.xml file that you previously downloaded when setting up the Splunk SAML application in the Google configuration steps.

This should complete most of the required fields. Other fields that you should set are:

• Entity ID
  • https://YOUR-INSTANCE.splunkcloud.com/
• Fully qualified domain name or IP of the load balancer
  • https://YOUR-INSTANCE.splunkcloud.com/
• Redirect port - load balancer port
  • 443
• Redirect to URL after logout
  • https://www.splunk.com/

The following screenshot shows an example of this:

4. Click Save to exit.

Testing

You are now ready to test. Open an Incognito browser and browse to your Splunk Cloud Platform instance. You should be redirected to Google for authentication. Once authenticated, you are redirected back to the Splunk Cloud instance as part of the normal SAML assertion flow.

Next steps

The following links might be helpful to implement this configuration advice:

• Set up your own custom SAML application
• SAML app error messages