Security and Compliance

Authentication

4min

Default

The default authentication method for TruffleHog uses Google Oauth or Magic Links for user management. Administrators must add each user by email that should have dashboard access to the Users page.

SAML SSO

Authentication can be configured to be handled by a SAML SSO identity provider (IdP). When this option is enabled, the IdP is responsible for user management.

Okta Configuration

  1. Select “Create a new app integration”
    Adding new app integration
    Adding new app integration
    
  2. Select a “SAML 2.0” app
    Select SAML 2.0 app
    Select SAML 2.0 app
    
  3. Set your app name and app logo
    Define the app tile
    Define the app tile
    
  4. Single Sign on URL → See Authentication page in TruffleHog dashboard
    Copy the ACS URL
    Copy the ACS URL
    
  5. Single sign on URL → See Assertion Consumer Service (ACS) URL on Authentication page in TruffleHog dashboard
  6. Audience URI → Base URL for your TruffleHog deployment. For example, if your ACS URL is https://real-strong-chipmunk.c1.prod.trufflehog.org/saml/acs, your Audience URI will be https://real-strong-chipmunk.c1.prod.trufflehog.org
  7. Name ID Format → EmailAddress
  8. Add the following Attribute Statements
    1. email → user.email
    2. firstName → user.firstName

    3. lastName → user.lastName

      Fill in the required fields
      Fill in the required fields
      
  9. Complete setup
  10. Go to the new app admin page
  11. Go to Sign On tab
  12. Open “View SAML setup instructions”
    Find the SAML setup instructions
    Find the SAML setup instructions
    
  13. Select the IDP metadata from the text box
    Copy the IDP metadata URL
    Copy the IDP metadata URL
    
  14. Paste the metadata content into the metadata field on the TruffleHog authentication page

Azure Configuration

  1. Go to Enterprise Applications, and select "New Application"
    Create a new application
    Create a new application
    
  2. Select "Create your own application"
    Select Create your own application
    Select Create your own application
    
  3. Enter the name of your application, and click Create
  4. Go to Single sign-on, and select SAML
    Select SAML method
    Select SAML method
    
  5. Edit Basic SAML Configuration
    1. Set Identifier to Audience URI from TruffleHog Authentication Page
    2. Set Reply URL to ACS URL from TruffleHog Authentication Page
    3. Save
  6. Go back to Single sign-on, and copy the App Federation Metadata Url and paste the Metadata URL in TruffleHog Authentication Page
    Copy the metadata URL
    Copy the metadata URL
    
  7. Edit Attributes & Claims and add the following:
    1. username: user.mail
    2. email: user.mail
    3. firstName: user.givenName

    4. lastName: user.surname

      Define the attributes and claims
      Define the attributes and claims
      
  8. Add users or groups to your application
    Add users or groups
    Add users or groups
    

Aditional Notes

  • If you are using an IdP that uses a subject that is unique for each session, add a 'username' attribute/claim that returns the user's email address.



Updated 15 May 2024
Doc contributor
Did this page help you?
PREVIOUS
Security and Compliance
NEXT
Architecture
Docs powered by Archbee