Skip to main content
Sumo Logic

Set Up SAML for Single Sign-On

  1. Last updated
    14:38, 18 Jul 2017
  2. Save as PDF

Organizations with Enterprise accounts can provision Security Assertion Markup Language (SAML) 2.0 to enable Single Sign-On (SSO) for user access to Sumo Logic.

In addition to basic SAML configuration, you can choose optional on-demand user creation (via SAML 2.0 assertions), and designate custom login and/or logout portals.

SAML Provisioning Process

The provisioning process works as follows:

  1. Identify the service provider you will use for SSO. For example:
  2. Configure SAML parameters in Sumo Logic.
  3. Configure service provider settings for Sumo Logic in the SSO system, and verify that any additional Role-Based Access Control (RBAC) roles and groups are set up.
  4. When provisioning is complete, users attempting to access Sumo Logic will be authenticated through the SSO system.

Limitations

  • SAML does not provide a deprovisioning mechanism. This means that if a user is deleted or disabled in the SSO database, it will not be reflected in Sumo Logic. However, these users would no longer be able to login to Sumo Logic via SSO. Administrators can delete these users from the Manage Data > Users and Roles > Users page (Manage > Users in classic UI) in Sumo Logic. When this is done, the user’s content is copied to the administrator who performed the deletion. The exception is access keys, and if SAML lockdown is not enabled, users would still be able to login via native accounts.
  • Access keys are NOT controlled by SAML. This means that if a user has been turned off on the SSO side, their access keys would still be valid. For this reason, administrators should audit users regularly and disable access keys when necessary.

Prerequisites

Before provisioning SAML, make sure you have the following:

  • An installed Identity Provider (IdP) SSO system that supports SAML 2.0. Several SAML IdPs are available. If your organization's IdP supports SAML 2.0 you can configure SAML in Sumo Logic. Examples: Microsoft ADFS, Okta, OneLogin.
  • X.509 certificate. This certificate is used to verify the signature in SAML assertions.
  • Valid email address. An Email Attribute is required in the assertion: either the SAML Subject or another SAML attribute per the SAML configuration. The value of the Email Attribute must be a valid email address. It is used to uniquely identify the user in the organization.

Configure SAML in Sumo Logic

Most of the information required for this procedure can be gathered from your IdP; the other options should be covered by your internal access policy.

  1. Go to Administration > Security > SAML (in classic UI, go to Manage > Security and click the SAML button).
  2. Select an existing configuration, or enter the name for a new configuration into the field and click Configure. 
  3. Enter the following. See Set Up ADFS to Authenticate Sumo Logic Users for specific information about using Microsoft ADFS as a SAML solution to configure Sumo Logic users.
  • Configuration Name: Enter a name to identify the SSO policy (or another name used internally to describe the policy).
  • Debug Mode: Select this option if you'd like to view additional details if an error occurs when a user attempts to authenticate. For more information, see View SAML Debug Information.
  • Issuer: Enter the unique URL assigned to your organization by the SAML IdP. 
    ADFS example:
http://adfs.myserver.tld/adfs/services/trust
  • Authn Request URL: Enter the URL that the IdP has assigned for Sumo Logic to submit SAML authentication requests to the IdP. 
    ADFS example:
https://adfs.myserver.tld/adfs/ls/
  • X.509 Certificate: Copy and paste your organization's X.509 certificate, which is used to verify signatures in SAML assertions. For ADFS, the certificate required is the Token-signing ADFS X.509 certificate.
  • Email Attribute: Depending on your IdP, select Use SAML subject, or select Use SAML attribute and type the email attribute name in the text box.
  • SP Initiated Login Configuration: Enter a unique identifier for your organization. You can specify any alphanumeric string, provided that it is unique to your organization (for example, yourcompanyname_oursumo). The identifier is used to generate a unique URL for user login.
    For example, if you enter yourcompanyname_oursumo, the login URL becomes:
https://service.sumologic.com/sumo/yourcompanyname_oursumo
  • On Demand Provisioning (optional): Select this option and specify the following attributes to have Sumo Logic automatically create accounts when a user first logs on. For more information, see Set Up Optional SAML features.
  • First Name Attribute: You might need to provide the full attribute path, which can vary based on the ADFS version (the actual path can be seen in the SAML assertion). The following are examples.
http://schemas.microsoft.com/ws/2008/06/identity/claims/givenname

http://schemas.microsoft.com/ws/2005/05/identity/claims/givenname
  • Last Name Attribute: You might need to provide the full attribute path, which can vary based on the ADFS version (the actual path can be seen in the SAML assertion). The following are examples.
http://schemas.microsoft.com/ws/2008/06/identity/claims/surname

http://schemas.microsoft.com/ws/2005/05/identity/claims/surname
  • Logout Page: Select this option and enter a URL if you'd like to point all users to the URL after logging out of Sumo Logic. For more information, see Set Up Optional SAML Features.
  • Roles Attribute: Enter the SAML Attribute Name that is sent by the IdP as part of the assertion. For details, see Set Up Optional SAML Features.
    Configure SAML
  1. Click Save.
  2. The following information is displayed.You'll need to provide one of these URLs when you configure settings for your IdP.
  • If your IdP requires HTTP-POST binding, copy the POST URL and paste it into your IdP’s site.
  • If your IdP requires HTTP-REDIRECT binding, copy the Redirect URL and paste it into your IdP’s site.
  1. Click Configure if you need to modify any settings. Click X to close the dialog box.
    Configure SAML details