SAML Integration in DefectDojo 2.2.1

[Sayaish87]

We are working on SSO setup for our DefectDojo instance. We are trying to use the SAML settings in an Azure AD enterprise app for SSO. We need the following information from the DefectDojo side to complete the setup.

Entity ID
Assertion Consumer Service URL
Sign on Url

Since I'm a beginner with DefectDojo could you point me the correct URLs. The settings file is below, I need to update with metadata info. Where can I find the metadata file or URL

[valentijnscholten]

Easiest integration is via OIDC: https://defectdojo.github.io/django-DefectDojo/dev/integrations/social-authentication/#azure-active-directory But there are also docs for general SAML2 integrations: https://defectdojo.github.io/django-DefectDojo/dev/integrations/social-authentication/#saml-20. Those urls are Azure URLs.

[JamonGrande]

https://yourDefectDojoInstance/saml2/metadata/

[JamonGrande]

Sample output from our work-in-progress:

<md:EntityDescriptor entityID="defectdojo" validUntil="2022-09-20T21:12:31Z">
md:Extensions
<ns1:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#md5"/>
<ns1:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#ripemd160"/>
<ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ns1:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224"/>
<ns1:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ns1:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
<ns1:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-md5"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha224"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
<ns1:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
</md:Extensions>
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="false" WantAssertionsSigned="true">
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://yourDefectDojoInstance/saml2/ls/"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://yourDefectDojoInstance/saml2/ls/post"/>
md:NameIDFormat
urn:oasis:names:tc:SAML:2.0:nameid-format:transient
</md:NameIDFormat>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://yourDefectDojoInstance/saml2/acs/" index="1"/>
<md:AttributeConsumingService index="1">
<md:ServiceName xml:lang="en"/>
<md:RequestedAttribute Name="urn:oid:1.2.840.113549.1.9.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Email" isRequired="true"/>
<md:RequestedAttribute Name="UserName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>
<md:RequestedAttribute Name="Firstname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="false"/>
<md:RequestedAttribute Name="Lastname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="false"/>
</md:AttributeConsumingService>
</md:SPSSODescriptor>
md:Organization
<md:OrganizationName xml:lang="es">redacted</md:OrganizationName>
<md:OrganizationName xml:lang="en">redacted</md:OrganizationName>
<md:OrganizationDisplayName xml:lang="es">redacted</md:OrganizationDisplayName>
<md:OrganizationDisplayName xml:lang="en">redacted</md:OrganizationDisplayName>
<md:OrganizationURL xml:lang="es">http://www.redacted.es</md:OrganizationURL>
<md:OrganizationURL xml:lang="en">http://www.redacted.com</md:OrganizationURL>
</md:Organization>
<md:ContactPerson contactType="technical">
md:Companyredacted</md:Company>
md:GivenNameredacted</md:GivenName>
md:SurNameredacted</md:SurName>
md:EmailAddress[email protected]</md:EmailAddress>
</md:ContactPerson>
<md:ContactPerson contactType="administrative">
md:Companyredacted</md:Company>
md:GivenNameredacted</md:GivenName>
md:SurNameredacted</md:SurName>
md:EmailAddress[email protected]</md:EmailAddress>
</md:ContactPerson>
</md:EntityDescriptor>

[JamonGrande]

This setup worked for us:

**OneLogin App/Connector Type:** SAML Custom Connector (Advanced)

Info tab
    Display Name: <Your instance name>

Configuration tab
    Audience (Entity ID): defectdojo
    Recipient: https://<yourURL>/saml2/acs/
    ACS (Consumer) URL Validator: ^<REGEXofYourACSurl>$
    ACS (Consumer) URL: https://<yourURL>/saml2/acs/
    Single Logout URL: https://<yourURL>/saml2/ls/
    Login URL: https://<yourURL>
    SAML initiator: OneLogin
    SAML nameID format: Transient
    SAML issuer type: Specific
    SAML signature element: Assertion

Parameters tab
    Email: Email
    Firstname: First Name
    Lastname: Last Name
    NameID value:  AD sAMAccountName
    UserName: Email

SSO tab
    SAML Signature Algorithm: SHA-256

Access tab
    <your applicable OneLogin Role(s)>