Single Sign-On on DefectDojo Documentation

Authorization Connectors

Mon, 01 Jan 0001 00:00:00 +0000

Authorization Connectors is one page listing every identity provider DefectDojo Pro supports, what state each one is in, and what protocol it speaks. Before it existed, each provider lived on its own settings form and there was no way to answer “what is set up on this instance?” without opening all of them.

Login Settings

Mon, 01 Jan 0001 00:00:00 +0000

Once you have an SSO provider working, Login Settings controls how the DefectDojo login page itself behaves — whether username/password login is still offered, whether visitors are sent straight to your identity provider, how long a session lasts, and whether SSO can create accounts on the fly. Open-source DefectDojo does not include these controls — see Authorized Users.

SAML Configuration

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro supports SAML authentication, configured from Connect > Authorization > Providers. Open-source DefectDojo does not include SSO — see Authorized Users for open-source access control.

OIDC

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro supports login via a generic OpenID Connect (OIDC) provider. Open-source DefectDojo does not include SSO — see Authorized Users for open-source access control.

Auth0

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro supports login via Auth0 over OAuth 2.0. Open-source DefectDojo does not include SSO — see Authorized Users for open-source access control.

Azure Active Directory

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro supports login via Microsoft Entra ID (Azure Active Directory) over OAuth 2.0, including automatic User Group synchronization. Open-source DefectDojo does not include SSO — see Authorized Users for open-source access control.

GitHub Enterprise

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro supports login via GitHub Enterprise Server over OAuth 2.0. Open-source DefectDojo does not include SSO — see Authorized Users for open-source access control.

GitLab

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro supports login via GitLab (SaaS or self-hosted) over OAuth 2.0. Open-source DefectDojo does not include SSO — see Authorized Users for open-source access control.

Google Auth

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro supports login via Google accounts over OAuth 2.0. New users are created automatically on first login if they don’t already exist, and existing DefectDojo users are matched to Google accounts by username (the portion before the @ in their Google email). Open-source DefectDojo does not include SSO — see Authorized Users for open-source access control.

KeyCloak

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro supports login via KeyCloak over OAuth 2.0. Open-source DefectDojo does not include SSO — see Authorized Users for open-source access control.