Skip to content

Commit a524447

Browse files
khorne3khorne3
authored
assorted SSO/SAML updates (#1926)
1 parent e990b43 commit a524447

File tree

4 files changed

+109
-89
lines changed

4 files changed

+109
-89
lines changed

‎docs/deployment/sso.md

+25-86
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ hide_title: true
77
tags:
88
- Deployment
99
- Semgrep AppSec Platform
10+
- SSO
1011
---
1112

1213
# Single-sign on (SSO) configuration
@@ -21,8 +22,8 @@ This article walks you through single-sign on (SSO) configuration. Semgrep suppo
2122

2223
## OpenID Connect / OAuth 2.0
2324

24-
:::warning
25-
Semgrep AppSec Platform does not support using OpenID with Microsoft Entra ID. Follow the instructions for [setting up SAML SSO with Microsoft Entra ID](#set-up-saml-sso-with-microsoft-entra-id) instead.
25+
:::note Microsoft Entra ID
26+
Semgrep AppSec Platform does not support using OpenID with Microsoft Entra ID. Follow the instructions to [set up SAML SSO with Microsoft Entra ID](/kb/semgrep-appsec-platform/saml-microsoft-entra-id) instead.
2627
:::
2728

2829
To set up SSO in Semgrep AppSec Platform:
@@ -47,104 +48,37 @@ If you encounter issues during the setup process, please reach out to [support@s
4748

4849
## SAML 2.0
4950

51+
:::note Google Workspace SAML
52+
If you're using Google Workspace SAML, see [SAML Single Sign-on with Google Workspace](/docs/kb/semgrep-appsec-platform/saml-google-workspace) for specific guidance.
53+
:::
54+
5055
SAML2.0 is configured through **Semgrep AppSec Platform**. To set up SSO:
5156

5257
1. Create a SAML app with your authentication provider.
5358
![Creating SAML app through Okta](/img/saml-creating-app.png#md-width)
54-
1. With your authentication provider, add in two attribute statements: `name` and `email`.
59+
2. With your authentication provider, add in two attribute statements: `name` and `email`.
5560
![Filling in attribute statements in Okta](/img/saml-attribute-statements.png#md-width)
56-
1. Sign in to Semgrep AppSec Platform.
57-
1. Navigate to **[Settings > Access > Login methods](https://semgrep.dev/orgs/-/settings/access/loginMethods)**.
58-
1. Click **Add SSO configuration** and select **SAML2 SSO**.
59-
1. Provide a **Display name** and the **Email domain**.
60-
2. Copy the **SSO URL** and **Audience URL (SP Entity ID)**, and provide it to your authentication provider.
61+
3. Sign in to Semgrep AppSec Platform.
62+
4. Navigate to **[Settings > Access > Login methods](https://semgrep.dev/orgs/-/settings/access/loginMethods)**.
63+
5. Click **Add SSO configuration** and select **SAML2 SSO**.
64+
6. Provide a **Display name** and the **Email domain**.
65+
7. Copy the **SSO URL** and **Audience URL (SP Entity ID)**, and provide it to your authentication provider.
6166
![Finding Single sign on URL, and Audience URI via Semgrep AppSec Platform](/img/saml-copy-urls.png#md-width)
62-
3. From your authentication provider, copy your **IdP SSO URL** and **IdP Issuer ID** values, and download the **X509 Certificate**.
67+
8. From your authentication provider, copy your **IdP SSO URL** and **IdP Issuer ID** values, and download the **X509 Certificate**.
6368
![Finding IdP SSO URL, IdP Issuer ID, and X509 Certificate through Okta](/img/saml-copy-IdPSSO-IdPID-and-X509.png#md-width)
64-
4. Return to Semgrep AppSec Platform, and paste the **IdP SSO URL** and **IdP Issuer ID** values, and upload your **X509 Certificate**.
69+
9. Return to Semgrep AppSec Platform, and paste the **IdP SSO URL** and **IdP Issuer ID** values, and upload your **X509 Certificate**.
6570
![Filling in IdP SSO URL, IdP Issuer ID, and X509 Certificate on Semgrep](/img/saml-filling-IdpSSO-IdpID-X509.png#md-width)
66-
5. Select the box next to **This SSO supports non-password authentication mechanisms (e.g. MFA, X509, PasswordLessPhoneSignin)** if applicable.
67-
6. Click **Save** to proceed.
68-
69-
If you are using Google Workspace SAML, see [SAML Single Sign-on with Google Workspace](/docs/kb/semgrep-appsec-platform/saml-google-workspace) for more specific guidance.
71+
10. Select the box next to **This SSO supports non-password authentication mechanisms (e.g. MFA, X509, PasswordLessPhoneSignin)** if applicable.
72+
11. Click **Save** to proceed.
7073

7174
If you encounter issues during the setup process, [reach out to support](/docs/support) for assistance.
7275

73-
### Set up SAML SSO with Microsoft Entra ID
74-
75-
<!--
76-
Semgrep AppSec Platform doesn't have an integration app in Microsoft Entra ID the way it does with Slack and GitHub.
77-
So, the user has to create a custom app (integration) for SAML SSO.
78-
We only use SOME steps in the documentation for Azure, so we'll have to make our own guide.
76+
:::note Admin and org owner accounts
77+
By default, Semgrep creates new SSO accounts with the **Member** role assigned. You can change the default role assigned to a new user by going to [Settings > Access](https://semgrep.dev/orgs/-/settings/access/defaults).
7978

80-
The following references are used:
81-
82-
-->
83-
84-
:::info Prerequisites
85-
* An existing Microsoft Entra ID account.
86-
* Sufficient permissions within Microsoft Entra ID to create enterprise apps. See [Microsoft Entra ID roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference).
79+
If you're an admin setting up SSO, and Semgrep creates an SSO account for you with the role of **Member**, you can elevate the permissions granted to your SSO account. To do so, log in to Semgrep with your admin account using the original login method, then [change the role](https://semgrep.dev/orgs/-/settings/access/members) of your newly created SSO account to **Admin**.
8780
:::
8881

89-
Setting up SAML SSO using Microsoft Entra ID consists of the following general steps:
90-
91-
1. Create a custom **enterprise app** within Microsoft Entra ID.
92-
2. Set up SAML SSO for your new enterprise app.
93-
3. Add users to your new enterprise app.
94-
95-
#### Create a custom enterprise app
96-
97-
<!-- Rather than using portal.azure.com, which takes us to Azure Dashboard, sign in straight away to Microsoft Entra ID -->
98-
99-
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
100-
2. Use the search bar to find and navigate to **enterprise applications**.
101-
![Microsoft Entra admin center's Enterprise applications screen](/img/entra-1.png#md-width)
102-
3. Click **New application** > **Create your own application**. A menu appears.
103-
![Create your own application screen](/img/entra-2.png#md-width)
104-
4. Name your new application something like `Semgrep SAML`.
105-
5. Select **Integrate any other application you don't find in the gallery (non-gallery)**.
106-
6. Click **Create**. This takes you to your new enterprise application's page.
107-
108-
You have now created a custom enterprise app for Semgrep to integrate with Microsoft Entra ID. This enables you to set up SAML SSO.
109-
110-
#### Set up SAML SSO for your new enterprise app
111-
112-
1. From your new enterprise app's page, go to **Single-sign on** > **SAML**.
113-
![Enterprise application's Single-sign on menu option](/img/entra-3.png#md-width)
114-
2. When prompted to **Select a single sign-on method**, select **SAML**. You are redirected to the **SAML-based Sign-on** page.
115-
![SAML-based Sign-on screen](/img/entra-4.png#md-width)
116-
3. In the **Basic SAML Configuration** section, click **Edit**. Provide the **Entity ID** and **Reply URL**. You can retrieve these values from Semgrep AppSec Platform by performing the following steps:
117-
1. Sign in to Semgrep AppSec Platform.
118-
2. Navigate to **[Settings > Access > Login methods](https://semgrep.dev/orgs/-/settings/access/loginMethods)**.
119-
3. Click **Add SSO configuration** and select **SAML2 SSO**.
120-
4. Copy the **Audience URL (SP Entity ID)** value from Semgrep AppSec Platform. Return to **Basic SAML Configuration**. Click **Add identifier** to paste this value as the **Identifier (Entity ID)**.
121-
5. Copy the **SSO URL** value from Semgrep AppSec Platform. Return to **Basic SAML Configuration**. Click **Add reply URL** to paste this value as the **Reply URL (Assertion Consumer Service URL)**.
122-
4. Click **Save** and close out of **Basic SAML Configuration**.
123-
5. In the **Attributes and Claims** section, click **Edit**. You must add two claims. To add your first claim:
124-
1. Click **Add new claim**.
125-
2. Enter `name` in the **Name** field.
126-
3. For the **Source attribute** drop-down box, select `user.displayname`.
127-
4. Click **Save**.
128-
6. To add your second claim:
129-
1. Click **Add new claim**.
130-
2. Enter `email` in the **Name** field.
131-
3. From the **Source attribute** drop-down box, select `user.mail`.
132-
4. Click **Save**.
133-
7. Close out of **Attributes & Claims**.
134-
8. Navigate to Semgrep AppSec Platform, and provide the values required by the SAML2 form:
135-
1. Provide the **Display name** and the **Email domain** you are using for the integration.
136-
2. Copy the **Login URL** value from Microsoft Entra ID and paste it in into Semgrep AppSec Platform's **IDP SSO URL** field.
137-
3. Copy and paste the **Microsoft Entra ID Identifier** value into Semgrep AppSec Platform's **IdP Issuer ID** field.
138-
4. In Entra ID's **SAML-based Sign-on** page, click **Download** to obtain the **Certificate (Base64)**.
139-
5. In Semgrep AppSec Platform, under **Upload/Paste certificate**, click **Browse** and then select the certificate you downloaded.
140-
![Semgrep AppSec Platform's SAML2 configuration screen](/img/entra-5.png#md-width)
141-
9. Select the box next to **This SSO supports non-password authentication mechanisms (e.g. MFA, X509, PasswordLessPhoneSignin)** if applicable.
142-
10. Click **Save** to proceed.
143-
144-
#### Add users to your new enterprise app
145-
146-
To add users to the application in so they can log in with their domain emails, refer to [Assign users and groups to an application](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal).
147-
14882
## Turn off sign in with GitHub / GitLab
14983

15084
If you have SSO enabled, you can turn off login using GitHub or GitLab credentials. Doing so forces members of your organization to log in using an email address with an approved domain.
@@ -157,3 +91,8 @@ If you have SSO enabled, you can turn off login using GitHub or GitLab credentia
15791
:::warning
15892
Ensure that you have at least one user who can log in through SSO before disabling sign in with GitHub or GitLab.
15993
:::
94+
95+
## See also
96+
97+
- [SAML SSO with Google Workspace](/docs/kb/semgrep-appsec-platform/saml-google-workspace)
98+
- [SAML SSO with Microsoft Entra ID](/docs/kb/semgrep-appsec-platform/saml-microsoft-entra-id)

‎docs/kb/semgrep-appsec-platform/saml-authentication-method-match.md

-2
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@ tags:
66
- SAML
77
---
88

9-
10-
119
# SAML SSO Error: Authentication method doesn't match requested
1210

1311
When logging in to Semgrep using SAML single-sign on (SSO), you may see the error `Authentication method doesn't match requested`:

‎docs/kb/semgrep-appsec-platform/saml-google-workspace.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ tags:
55
- SSO
66
---
77

8-
# SAML Single Sign-on with Google Workspace
8+
# SAML SSO with Google Workspace
99

1010
This article describes how to set up SAML Single Sign-on for Semgrep AppSec Platform with Google Workspace, including how to set up the necessary attribute mappings.
1111

‎docs/kb/semgrep-appsec-platform/saml-microsoft-entra-id.md

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
description: Learn how to set up SAML access to Semgrep AppSec Platform with Microsoft Entra ID.
3+
tags:
4+
- Semgrep AppSec Platform
5+
- SSO
6+
---
7+
8+
# SAML SSO with Microsoft Entra ID
9+
10+
This article describes how to set up SAML Single Sign-on for Semgrep AppSec Platform with Microsoft Entra ID.
11+
12+
<!--
13+
Semgrep AppSec Platform doesn't have an integration app in Microsoft Entra ID the way it does with Slack and GitHub.
14+
So, the user has to create a custom app (integration) for SAML SSO.
15+
We only use SOME steps in the documentation for Azure, so we'll have to make our own guide.
16+
17+
The following references are used:
18+
19+
-->
20+
21+
:::info Prerequisites
22+
* An existing Microsoft Entra ID account.
23+
* Sufficient permissions within Microsoft Entra ID to create enterprise apps. See [Microsoft Entra ID roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference).
24+
:::
25+
26+
Setting up SAML SSO using Microsoft Entra ID consists of the following general steps:
27+
28+
1. Create a custom **enterprise app** within Microsoft Entra ID.
29+
2. Set up SAML SSO for your new enterprise app.
30+
3. Add users to your new enterprise app.
31+
32+
## Create a custom enterprise app
33+
34+
<!-- Rather than using portal.azure.com, which takes us to Azure Dashboard, sign in straight away to Microsoft Entra ID -->
35+
36+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
37+
2. Use the search bar to find and navigate to **enterprise applications**.
38+
![Microsoft Entra admin center's Enterprise applications screen](/img/entra-1.png#md-width)
39+
3. Click **New application** > **Create your own application**. A menu appears.
40+
![Create your own application screen](/img/entra-2.png#md-width)
41+
4. Name your new application something like `Semgrep SAML`.
42+
5. Select **Integrate any other application you don't find in the gallery (non-gallery)**.
43+
6. Click **Create**. This takes you to your new enterprise application's page.
44+
45+
You have now created a custom enterprise app for Semgrep to integrate with Microsoft Entra ID. This enables you to set up SAML SSO.
46+
47+
## Set up SAML SSO for your new enterprise app
48+
49+
1. From your new enterprise app's page, go to **Single-sign on** > **SAML**.
50+
![Enterprise application's Single-sign on menu option](/img/entra-3.png#md-width)
51+
2. When prompted to **Select a single sign-on method**, select **SAML**. You are redirected to the **SAML-based Sign-on** page.
52+
![SAML-based Sign-on screen](/img/entra-4.png#md-width)
53+
3. In the **Basic SAML Configuration** section, click **Edit**. Provide the **Entity ID** and **Reply URL**. You can retrieve these values from Semgrep AppSec Platform by performing the following steps:
54+
1. Sign in to Semgrep AppSec Platform.
55+
2. Navigate to **[Settings > Access > Login methods](https://semgrep.dev/orgs/-/settings/access/loginMethods)**.
56+
3. Click **Add SSO configuration** and select **SAML2 SSO**.
57+
4. Copy the **Audience URL (SP Entity ID)** value from Semgrep AppSec Platform. Return to **Basic SAML Configuration**. Click **Add identifier** to paste this value as the **Identifier (Entity ID)**.
58+
5. Copy the **SSO URL** value from Semgrep AppSec Platform. Return to **Basic SAML Configuration**. Click **Add reply URL** to paste this value as the **Reply URL (Assertion Consumer Service URL)**.
59+
4. Click **Save** and close out of **Basic SAML Configuration**.
60+
5. In the **Attributes and Claims** section, click **Edit**. You must add two claims. To add your first claim:
61+
1. Click **Add new claim**.
62+
2. Enter `name` in the **Name** field.
63+
3. For the **Source attribute** drop-down box, select `user.displayname`.
64+
4. Click **Save**.
65+
6. To add your second claim:
66+
1. Click **Add new claim**.
67+
2. Enter `email` in the **Name** field.
68+
3. From the **Source attribute** drop-down box, select `user.mail`.
69+
4. Click **Save**.
70+
7. Close out of **Attributes & Claims**.
71+
8. Navigate to Semgrep AppSec Platform, and provide the values required by the SAML2 form:
72+
1. Provide the **Display name** and the **Email domain** you are using for the integration.
73+
2. Copy the **Login URL** value from Microsoft Entra ID and paste it in into Semgrep AppSec Platform's **IDP SSO URL** field.
74+
3. Copy and paste the **Microsoft Entra ID Identifier** value into Semgrep AppSec Platform's **IdP Issuer ID** field.
75+
4. In Entra ID's **SAML-based Sign-on** page, click **Download** to obtain the **Certificate (Base64)**.
76+
5. In Semgrep AppSec Platform, under **Upload/Paste certificate**, click **Browse** and then select the certificate you downloaded.
77+
![Semgrep AppSec Platform's SAML2 configuration screen](/img/entra-5.png#md-width)
78+
9. Select the box next to **This SSO supports non-password authentication mechanisms (e.g. MFA, X509, PasswordLessPhoneSignin)** if applicable.
79+
10. Click **Save** to proceed.
80+
81+
## Add users to your new enterprise app
82+
83+
To add users to the application in so they can log in with their domain emails, refer to [Assign users and groups to an application](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal).

0 commit comments

Comments
 (0)