Azure AD SSO Configuration for DefectDojo

Azure AD SSO Configuration for DefectDojo

Azure AD App Registration Setup

Step 1: Create App Registration

1. Go to Azure Portal > Azure Active Directory > App registrations
2. Click "New registration"
3. Configure:
   • Name: DefectDojo
   • Supported account types: "Accounts in this organizational directory only"
   • Redirect URI: Web - https://defectdojo.dev.cafehyna.com.br/complete/azuread-tenant-oauth2/

Step 2: Configure API Permissions

Add these Application permissions (not Delegated):

Grant admin consent after adding permissions.

Step 3: Configure Token Claims

1. Go to App Registration > Token configuration
2. Add Groups claim:
   • Click "Add groups claim"
   • Select "All groups"
   • Important: Do NOT check "Emit groups as role claims"

Step 4: Create Client Secret

1. Go to Certificates & secrets
2. Create new client secret
3. Store in Azure Key Vault as defectdojo-azuread-client-secret

DefectDojo Environment Variables

Required Variables

extraEnv:
  # Enable Azure AD OAuth2 authentication
  - name: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_ENABLED
    value: "True"

  # Azure AD Application (client) ID
  - name: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY
    value: "79ada8c7-4270-41e8-9ea0-1e1e62afff3d"

  # Azure AD Directory (tenant) ID
  - name: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID
    value: "3f7a3df4-f85b-4ca8-98d0-08b1034e6567"

  # Azure AD Client Secret (from Key Vault)
  - name: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET
    valueFrom:
      secretKeyRef:
        name: defectdojo
        key: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET

Group Synchronization Variables

extraEnv:
  # Enable group sync from Azure AD
  - name: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_GET_GROUPS
    value: "True"

  # Clean up empty groups
  - name: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_CLEANUP_GROUPS
    value: "True"

  # Filter groups by regex pattern
  - name: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_GROUPS_FILTER
    value: "^G-Usuarios-DefectDojo-.*"

SSL/Security Variables

Required when behind a TLS-terminating proxy:

extraEnv:
  # Secure cookies
  - name: DD_SESSION_COOKIE_SECURE
    value: "True"
  - name: DD_CSRF_COOKIE_SECURE
    value: "True"

  # Trust proxy headers
  - name: DD_SECURE_PROXY_SSL_HEADER
    value: "True"

  # IMPORTANT: Set to False behind NGINX Ingress to avoid redirect loops
  - name: DD_SECURE_SSL_REDIRECT
    value: "False"

Optional SSO Behavior Variables

extraEnv:
  # Auto-redirect to Azure AD login (skip username/password form)
  - name: DD_SOCIAL_LOGIN_AUTO_REDIRECT
    value: "True"

  # Hide traditional login form
  - name: DD_SOCIAL_AUTH_SHOW_LOGIN_FORM
    value: "False"

Azure AD Groups for DefectDojo Roles

Recommended Group Structure

Setting Up Group-Role Mapping

1. Create Azure AD Groups:

   • Go to Azure Portal > Azure Active Directory > Groups
   • Create groups matching the naming pattern above
   • Add users to appropriate groups

2. Enable Group Sync in DefectDojo:

   - name: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_GET_GROUPS
     value: "True"
   - name: DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_GROUPS_FILTER
     value: "^G-Usuarios-DefectDojo-.*"
   

3. Create Matching Groups in DefectDojo:

   • Go to DefectDojo > Configuration > Groups
   • Create groups with exact same names as Azure AD groups
   • Assign appropriate Global Role to each group

4. User Login:

   • Users log in via Azure AD SSO
   • Groups are synced during login
   • Users inherit roles from their group memberships

Troubleshooting SSO Issues

Error: ADSTS50011 - Redirect URI Mismatch

Cause: Azure AD requires HTTPS, but DefectDojo sending HTTP redirect

Solution:

1. Verify redirect URI in Azure AD is exactly: https://defectdojo.dev.cafehyna.com.br/complete/azuread-tenant-oauth2/

2. Set SSL environment variables:

   - name: DD_SESSION_COOKIE_SECURE
     value: "True"
   - name: DD_CSRF_COOKIE_SECURE
     value: "True"
   - name: DD_SECURE_PROXY_SSL_HEADER
     value: "True"
   

Error: Groups Not Syncing

Symptoms: User logged in but shows "No group members found"

Checklist:

• DD_SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_GET_GROUPS=True
• Azure AD App has Group.Read.All permission (Application type)
• Admin consent granted for API permissions
• Token configuration has Groups claim (not role claims)
• "Emit groups as role claims" is NOT enabled
• User logged out and back in after configuration change
• Matching groups exist in DefectDojo UI

Error: 403 Forbidden from Graph API

Cause: Missing or incorrect API permissions

Solution:

1. Go to Azure AD > App Registration > API Permissions
2. Add Group.Read.All as Application permission
3. Click "Grant admin consent"
4. Restart DefectDojo pods

Emergency Access

If SSO is broken and you're locked out:

https://defectdojo.dev.cafehyna.com.br/login?force_login_form

This bypasses SSO redirect and shows the standard login form.