User Management on DefectDojo Documentation

Audit Logs

Mon, 01 Jan 0001 00:00:00 +0000

Audit logs for DefectDojo can be accessed in a few different ways.

Individual Object Logs

DefectDojo objects each have an associated Object History, which can be accessed through the UI. These histories are recorded for Assets, Engagements, Tests, Findings and Endpoints, as well as Risk Acceptances.

In the Classic (Open-Source) UI, Object Logs are found under the ☰ hamburger menu in an object’s view.

Audit Logs

Mon, 01 Jan 0001 00:00:00 +0000

Audit Logs provide a chronological record of actions performed within DefectDojo. They ensure accountability and compliance by recording which user performed which action and when.

Creating a new user

Mon, 01 Jan 0001 00:00:00 +0000

This page describes the recommended onboarding workflow for adding new users to a DefectDojo instance. DefectDojo users can be used as both standard, human-operated accounts and as service accounts.

Creating a new user

Mon, 01 Jan 0001 00:00:00 +0000

This page describes the recommended onboarding workflow for adding new users to a DefectDojo instance. For automation (pipelines, scanners), use a service user instead: it needs no email address or password and its API token is shown when it is created.

Open-Source Permissions

Mon, 01 Jan 0001 00:00:00 +0000

Open-source DefectDojo controls access to Assets and Organizations with the Authorized Users model. Each Asset and Organization has an Authorized Users panel listing the people who can see that record and the data nested under it.

Permissions in DefectDojo

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro feature. The Members / Groups / Global Roles RBAC system described on this page is part of DefectDojo Pro. Open-source DefectDojo uses the Authorized Users model — see that page for open-source access control, and the 3.0 upgrade notes if you’re moving between editions.

Re-enabling login for SSO users

Mon, 01 Jan 0001 00:00:00 +0000

When this applies

SSO (SAML, OIDC, OAuth) is a DefectDojo Pro feature. If you upgrade to open-source DefectDojo 3.x (or otherwise move off Pro), the SSO login options are removed, and users who were provisioned through SSO can no longer log in. Their accounts were never given a local password, and the UI and API will not let you set one for them: DefectDojo detects them as SSO accounts and blocks the change.

Resetting User Credentials in Bulk

Mon, 01 Jan 0001 00:00:00 +0000

The DefectDojo Pro Users list lets you rotate API tokens and force password resets for many users at once — useful for periodic credential hygiene or responding to a suspected credential exposure.

Service Users

Mon, 01 Jan 0001 00:00:00 +0000

A service user is a DefectDojo user meant for automation: a CI/CD pipeline, a scanner, a Kubernetes workload. It has no email address and no password, it can never sign in to the UI, and it holds one API token that is shown once, when it is created or regenerated. Everything else about it works like any other user: it is authorized through a global role, Asset and Organization memberships and groups.

Set a User's permissions

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro feature. The Members / Groups / Global Roles RBAC system described on this page is part of DefectDojo Pro. Open-source DefectDojo uses the Authorized Users model — see that page for open-source access control, and the 3.0 upgrade notes if you’re moving between editions.