Authentication and Authorization
SAML in BloodHound
BloodHound supports SAML 2.0 for Single Sign On to authenticate users to your tenant environment.
This integration provides authentication only, user creation and role management will still occur from within BloodHound’s “Manage Users” interface.
You may configure multiple SAML providers within your tenant if necessary.
This page provides the overall steps to configure a SAML provider within BloodHound. We have provided walkthroughs for creating the configuration within the provider for your convenience.
Order of Operations
Currently, BloodHound requires the configuration of SAML system in the following order:- Determine the Provider Name you will utilize for the SAML configuration.
- The same value must be configured in both the Identity Provider and BloodHound.
- Configure Identity Provider for BloodHound.
- Create the SAML Configuration in BloodHound.
- Create new users or modify existing users to utilize the newly created SAML provider.
- You must ensure SAML users do not share email with built-in users.
SAML Attribute Quick Reference
| Data Type | Value |
|---|---|
| IDP Name Format | urn:oasis:names:tc:SAML:2.0:attrname-format:uri |
| Required SAML Attributes | Either of the following will map to the user’s email address in BloodHound: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress urn:oid:0.9.2342.19200300.100.1.3 |
BloodHound Icons
If your IDP supports custom icons for configured applications, please feel free to utilize either of the two logos below:
Create the SAML Configuration
Ensure you have configured an Identity Provider for BloodHound as described in Order of Operations before proceeding.- While logged in as an Administrator, click on the gear icon in the top right, then click “Administration.”
- Under the “Authentication” section, choose “SAML Configuration.”
- Click “Create SAML Provider.”
- Give the SAML provider the name you used in the ACS URL (‘okta’ in this example) and upload the metadata.xml you created previously. Click “Submit.”
- BloodHound will provide the URLs related to this new SAML provider integration. Please take a moment to verify that the ACS URL matches the Single sign on URL specified in the SAML application integration page during setup of the Okta SAML integration.
Configure Users for SAML Authentication
By default, all users will utilize username and password via the built-in authentication service. When creating or modifying a user, you will be granted the option to change this setting. When creating a new SAML user, you must ensure the SAML user does not share email with any built-in users.- While logged in as an Administrator, click on the gear icon in the top right, then click “Administration.”
- Under the “Authentication” section, choose “SAML Configuration.”
- Locate the user you wish to configure for SAML authentication, click the hamburger menu button on the right side of the row, then “Update User.”
- In the following dialog, modify the Authentication Method to “SAML” then select the appropriate SAML provider you wish the user’s account to authenticate against.
- Click “Save.”
