Set Up SAML for Single Sign-On

All SAML integrations on the same Sumo deployment share the same EntityID

All SAML integrations on the same Sumo deployment send SP-initiated authentication requests with the same EntityID. This can pose issues if your IdP expects all integrations to connect to the same authentication URL. Specifically:

• Your IdP might not let you configure more than one SAML integration because it requires each EntityID to be unique.
• If your IdP does allow you to configure an additional integration, the IdP will not be able to determine which integration to use when it receives an AuthnRequest message with the common EntityID. In that case, the IdP would typically use the first integration, resulting in SAML logins failures for the additional integrations.

To avoid these issues, if your IdP expects all integrations to connect to the same authentication URL, we recommend that you use IdP-initiated SSO (rather than SP-initiated) for each of your SAML integrations.

Access keys are not controlled by SAML

This means that if a user has been turned off on the SSO side, their access keys would still be valid. For this reason, administrators should audit users regularly and disable access keys when necessary.

SAML does not provide a deprovisioning mechanism 

This means that if a user is deleted or disabled in the SSO database, it will not be reflected in Sumo Logic. However, these users would no longer be able to login to Sumo Logic via SSO. Administrators can delete these users from the Administration > Users and Roles > Users page in Sumo Logic. When this is done, the user’s content is copied to the administrator who performed the deletion. The exception is access keys, and if SAML lockdown is not enabled, users would still be able to login via native accounts.

Only one certificate for each SAML configuration is currently supported

Only one token-signing ADFS X.509 for each SAML configuration is currently supported. When you need to do a certificate refresh on the ADFS server, you must update the Sumo certificate afterwards.

Configure SP-initiated Login 

This section has instructions for setting up SP-initiated login. In this configuration, when a Sumo user logs in, Sumo redirects the user to your IdP with a SAML AuthnRequest. The request contains the information that your IdP needs to authenticate the user. Your IdP replies to Sumo with a SAML Assertion (SAMLResponse).

In the steps below, you provide the information necessary for Sumo to issue the AuthnRequest to your IdP.

1. Click SP Initiated Login Configuration in the Optional Settings section of the SAML configuration page.  When you click this option, the Login Path and Authn Request URL fields appear. 

2. Login Path. Enter a unique identifier for your org. You can specify any alphanumeric string (with no embedded spaces), provided that it is unique to your org. (You can't configure a Login Path that another Sumo customer has already configured). The identifier is used to generate a unique URL for user login. For example, if you enter "yourcompanyname", the login URL for the HTTP redirect binding will be:

   https://service.deployment.sumologic.com/sumo/saml/redirect/yourcompanyname

   And the login URL for the HTTP POST binding will be:

   https://service.deployment.sumologic.com/sumo/saml/post/yourcompanyname

   where deployment is your specific deployment: us2|eu|au

3. Authn Request URL. Enter the URL that the IdP has assigned for Sumo Logic to submit SAML authentication requests to the IdP.  This field is required if you checked the SP Initiated Login Configuration checkbox.
   
   ADFS example:
   
   https://adfs.myserver.tld/adfs/ls/

4. Disable Requested Authn Context. If you check this option, Sumo will not include the RequestedAuthnContext element of the SAML AuthnRequests it sends to your Idp. This option is useful if your IdP does not support the RequestedAuthnContext element

5. (Optional) Sign Authn Request. If you select this option, Sumo will send signed Authn requests to your IdP. When you click this option, a Sumo-provided X-509 certificate is displayed. You can configure your IDP with this certificate, to use to verify the signature of the Authn requests sent by Sumo. 

6. If you are done configuring optional SAML features, click Add to save your changes, and proceed to Review SAML configuration. To configure optional SAML features, see the following section. 

Configure Roles attribute

If you enable the Roles Attribute option, Sumo Logic assigns roles to a user every time the user logs in. Roles are configured by your IdP and assigned as part of the SAML assertion.

1. Click the Roles Attribute checkbox. The Roles Attribute field appears.
2. Roles Attribute. Enter the SAML Attribute Name that is sent by the IdP as part of the assertion.
   • Each role in the assertion must be in its own AttributeValue. (Do not use a comma separated list.)
   • The AttributeValue values of the SAML assertion must match the role names configured in Sumo Logic.
   See the following assertion example using multiple roles:

   <saml:Attribute Name="Sumo_Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Analyst</saml:AttributeValue>
<saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Collector Manager</saml:AttributeValue>
</saml:Attribute>
   
   
   In this example, the SAML Attribute Name "Sumo_Role" would go in the Roles Attribute field.

   Each role name, such as Analyst and Collector Manager, must match roles that exist in Sumo Logic.

3. If you are done configuring optional SAML features, click Add to save your changes, and proceed to Review SAML configuration. To configure optional SAML features, see the following section. 

Configure on-demand provisioning

If you configure on-demand provisioning, Sumo Logic automatically creates a user account the first time a user logs on to Sumo. To complete this procedure, you need to supply the First Name and Last Name attributes your IdP uses to identify users.

When the account is created, Sumo Logic credentials are emailed to the user. (Users need both Sumo Logic credentials and SAML permissions.)

1. Click the On Demand Provisioning checkbox.
2. First Name Attribute. You might need to provide the full attribute path, which can vary based on the ADFS version (the actual path can be seen in the SAML assertion). The following are examples.
   
   http://schemas.microsoft.com/ws/2008/06/identity/claims/givenname
    
3. Last Name Attribute. You might need to provide the full attribute path, which can vary based on the ADFS version (the actual path can be seen in the SAML assertion). The following are examples.
   
   http://schemas.microsoft.com/ws/2008/06/identity/claims/surname
    
4. On Demand Provisioning Roles. Specify the Sumo RBAC roles you want to assign when user accounts are provisioned. (The roles must already exist.)
5. If you are done configuring optional SAML features, click Add to save your changes, and proceed to Review SAML configuration.  

Configure logout page

Configure a logout page if you would like to point Sumo users to a particular URL after logging out of Sumo Logic or after their session has timed out. You could choose your company's intranet, for example, or any other site that you'd prefer users in your organization access.

1. Click the Logout Page checkbox.
2. Enter the URL of the page to which you want to direct users after logging of Sumo.
3. Click Add to save your configuration, and proceed to Review SAML configuration.