Skip to main content
Splunk Agent Observability provides Single sign-on capabilities for various providers using the OIDC protocol when using your own cluster. If your provider is not listed above, additional SSO providers can be added on-demand. Contact Splunk Agent Observability to enable this.
Single sign-on is only supported when you are using your own Splunk Agent Observability cluster. This is not available in the free or hosted version of Splunk Agent Observability.

​
Google

  1. Follow this guide to set up your OAuth credentials
    • User Type is Internal
    • Scopes are .../auth/userinfo.profile and openid
    • Authorized domains is your domain for Splunk Agent Observability
  2. When creating a new client ID, set:
    • type to Web application
    • Authorized redirect URIs to https://{CONSOLE_URL}/api/auth/callback/google, replacing {CONSOLE_URL} with your Splunk Agent Observability URL
  3. Share your Client ID and Client Secret with Splunk Agent Observability

​
Microsoft Entra ID

  1. Follow this guide to create a new application
  2. Under Redirect URI, set:
    • The type to Web
    • The URI to https://{CONSOLE_URL}/api/auth/callback/azure-ad, replacing {CONSOLE_URL} with your Splunk Agent Observability URL
  3. Go to Token configuration page, Add Optional Claim, choose the ID token and email claim. Ensure each user has their email set in the Contact Information properties. Splunk Agent Observability will use this email as the account.
  4. Go to the Certificates & secrets page, select New Client Secret, and create a new secret
  5. Share the Tenant ID, Client ID, and Client Secret with Splunk Agent Observability

​
Okta

  1. Follow this guide to create a new application
  2. Select:
    • OIDC - OpenID Connect as the Sign-in method
    • Web Application as the application type
    • Authorization Code as the Grant Type
  3. Set Sign-in redirect URIs to https://{CONSOLE_URL}/api/auth/callback/okta, and Sign-out redirect URIs to https://{CONSOLE_URL}, replacing {CONSOLE_URL} with your Splunk Agent Observability URL
  4. Share the Issuer URL, Client ID, and Client Secret with Splunk Agent Observability. You can find the Issuer URL in Security -> API in the admin panel. The audience should be api://default.

​
PingFederate

  1. Follow this guide to create an application
  2. Set the Application Type to OIDC Web App
  3. Go to the app configuration page, and set the Redirect URIs to https://{CONSOLE_URL}/api/auth/callback/custom, replacing {CONSOLE_URL} with your Splunk Agent Observability URL
  4. Share the Environment ID, Client ID, and Client Secret with Splunk Agent Observability

​
Custom OIDC Provider

  1. Create an application/client with OIDC as the protocol, Web Application as the application type, and Authorization Code as the Grant Type
    1. Ensure an email claim is returned as part of the ID Token
  2. Set Sign-in redirect URIs to https://{CONSOLE_URL}/api/auth/callback/custom, Sign-out redirect URIs to https://{CONSOLE_URL}, and Web origins to https://{CONSOLE_URL}, replacing {CONSOLE_URL} with your Splunk Agent Observability URL
  3. Create a Client Secret
  4. Share all these with Splunk Agent Observability:
    1. CLIENT_ID
    2. CLIENT_SECRET
    3. TOKEN_URL (e.g. https://{BASE_URL}/token)
    4. USERINFO_URL (e.g. https://{BASE_URL}/userinfo)
    5. ISSUER
    6. JWKS_URL (e.g. https://{BASE_URL}/certs)
    7. AUTHORIZATION_URL (e.g. https://{BASE_URL}/auth?response_type=code)