Connect to your IdP with SAML 2.0

Black Duck Portal documentation

How to configure a SAML 2.0 Single Sign-On connection between your Identity Provider (IdP) and Black Duck Portal, enabling users to authenticate through your organization's identity system.

Prerequisites

Setting up single sign-on requires the following:

  • Organization Administrator permissions in Black Duck Portal.
  • An IdP that supports SAML 2.0.
  • Sufficient permissions to create an integration with Black Duck Portal in your IdP.

Connect to your IdP with SAML 2.0

Follow these steps to set up an SSO connection with your IdP using SAML 2.0.
Note: By default, SAML connections use service-provider-initiated (SP-initiated) authentication. After you enable single sign-on, users must access Black Duck Portal directly to start the authentication process.
  1. In Black Duck Portal, go to Org Admin > SSO Connections and select + Create SSO Connection.

    The Create SSO Connection page opens.

  2. If necessary, replace your tenant ID GUID in the Configuration Name field with a friendly name. The Configuration Name must be unique. In this example, we will name it example-saml-connection.
    Important: We strongly recommend you do not change the configuration name.

    Configuration names can be up to 64 alphanumeric characters long and can include dashes.

  3. Select SAML using the Identity Provider Strategy dropdown.
  4. Select Create Connection.

    The Configuration URLs tab opens.

  5. Use the SAML Metadata URL, Assertion Consumer Service (ACS) URL, SAML Request Signing Certificate, and Entity ID (Issuer) values to set up a connection to Black Duck Portal in your IdP.
    Note: The steps to complete this step vary from IdP to IdP. When you register Black Duck Portal as an application in your IdP, your IdP will generate several values you'll need later on, including:
    • Sign In Endpoint
    • Sign Out Endpoint
    • X.509 Signing Certificate
    • Entity ID
  6. Select Continue to Configuration.

    The Configure Connection tab opens.

  7. Enter your SAML connection information in the form.
    Table 1. Configure Connection Details for SAML form, fields reference
    Field Description
    Entity ID (Issuer) This is the unique identifier for your SAML connection. Use this value when configuring your IdP.
    Sign In Endpoint An endpoint provided by your IdP that authentication requests are sent to. Retrieve this value from your IdP.
    Sign Out Endpoint (Optional) An endpoint provided by your IdP that log out requests are sent to. Retrieve this value from your IdP.
    X.509 Signing Certificate Retrieve this value from your IdP.
    Tip: Often, this value appears in your IdP after you set up a connection to Black Duck Portal. You may be able to retrieve this from your IdP's SAML discover endpoint or metadata endpoint. How to find this varies from IdP to IdP, so refer to your IdP's documentation.

    Example SAML metadata from Salesforce (SFDC) is listed below, with a fake certificate in the X509Certificate element.

    <EntityDescriptor entityID="urn:id.blackduck.com">
    <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <KeyDescriptor use="signing">
        <KeyInfo>
            <X509Data>
                <X509Certificate>
                    iIIDojCCAoqgAwIBAgIGAZMxTJMdfsdjhfkjGMKSFkgndflisgdiswCQYDVQQGnn EwJVUzETMBEGA1Ukjb4l12b3lK4B1L2KH4BKLHBKB4L12K3KJJKBKBlhbklhbljj gdjkbaskhfblhKBLFSDABFLSDHJKB3LHBLKklhbjh3b4j23h4bj2k690098u41bk
                </X509Certificate>
            </X509Data>
        </KeyInfo>
    </KeyDescriptor>
    Signature Algorithm (Optional) The algorithm used for signing (default: rsa-sha256).
    Digest Algorithm (Optional) The algorithm used to create message digests in SAML messages (default: sha256).
    Email Domain for Home Realm Discovery (Optional) Comma-separated list of email domains that automatically direct users to this IdP connection when they sign in. For example: 
    company.com,subsidiary.com

    When users with matching email domains access the login page, they're routed directly to this IdP without needing to select it manually. This simplifies login for organizations with multiple IdPs or domains.
  8. Select Save Configuration.

(Optional) Enable SCIM provisioning

Now you have the option to enable System for Cross-domain Identity Management (SCIM) provisioning.

SCIM provisioning automates user lifecycle management between your identity provider and Black Duck Portal. While SSO handles authentication, SCIM provisioning handles provisioning—automatically creating, updating, and removing user accounts based on changes in your identity provider.

See Enable SCIM provisioning (optional) for more information.

(Optional) Enable IdP-initiated SSO

By default, Black Duck Portal uses SP-initiated authentication, where users access Black Duck Portal to start the authentication process. IdP-initiated authentication reverses this: the login flow begins at your IdP, which sends an unsolicited response to Black Duck Portal.

CAUTION:
IdP-initiated authentication is less secure and is not recommended. Use SP-initiated SSO whenever possible.

See Enable IdP-initiated SSO (optional) for more information.

Next steps

Next, grant users access to Black Duck Portal in your IdP. The steps to complete this vary from IdP to IdP.
Important: After you grant a user access to Black Duck Portal, the user must sign in to Black Duck Portal successfully (using single sign-on) before their user information appears on the Users tab (Org Admin > Users).