SAML (SaaS)

SAML support in the Sysdig platform allows authentication via your choice of Identity Provider (IdP).

The Sysdig platform ordinarily maintains its own user database to hold a username and password hash. SAML instead allows for redirection to your organization’s IdP to validate username/password and other policies necessary to grant access to Sysdig applications. Upon successful authentication via SAML, a corresponding user record in the Sysdig platform’s user database is automatically created, though the password that was sent to the IdP is never seen nor stored by the Sysdig platform.

This section describes how to integrate and enable SAML with both Sysdig Monitor and Sysdig Secure.

Basic Enablement Workflow

1. Determine which IdP your company uses and will be configuring.

• Okta (SAML)

• OneLogin (SAML)

• Microsoft Entra ID (SAML)

• Google Workspace (SAML)

These are the IdPs for which Sysdig has performed detailed interoperability testing and confirmed how to integrate using their documentation. Even if your IdP is not listed, it might still work with the Sysdig platform. Contact Sysdig Support for help.

2. Decide the login flow you want users to experience - choose one of the following options:

• Click the SAML button and enter a company name.
• Open the domain URL corresponding to your Sysdig application and region and enter your company name. For example, domain URLs of Monitor and Secure for US East are app.sysdigcloud.com and secure.sysdig.com respectively. See SaaS Regions and IP Ranges for other regions.

• Type or bookmark a URL in the browser.

  For example, the URLs for the US East are:

  Monitor: https://app.sysdigcloud.com/api/saml/COMPANY_NAME?redirectRoute=%2F&companyName=COMPANY_NAME

  Secure: https://secure.sysdig.com/api/saml/COMPANY_NAME?product=SDS&redirectRoute=%2F&companyName=COMPANY_NAME

  For example, for the EU region:

  Monitor: https://eu1.app.sysdig.com/api/saml/COMPANY_NAME?redirectRoute=%2F&companyName=COMPANY_NAME

  Secure: https://eu1.app.sysdig.com/api/saml/COMPANY_NAME?product=SDS&redirectRoute=%2F&companyName=COMPANY_NAME

• Log in from an IdP interface. The individual IdP integration pages describe how to add Sysdig to the IdP interface.

  You need your Sysdig customer number.

3. Perform the configuration steps in your IdP interface and collect the resulting configuration attributes. Check your IdP information in step 1. Collect metadata URL (or XML) and test it. If you intend to configure IdP-initiated login flow, have your Sysdig customer number ready. It will be referenced in later configuration steps as CUSTOMER_ID_NUMBER.

4. Log in to Sysdig Monitor or Sysdig Secure Settings as Admin and enter the necessary configuration information in the UI. Enable SAML as your SSO.

Ensure that you enter a separate redirect URL in your IdP for each product; otherwise, the integration processes are the same.

Administrator Steps

1. Configure IdP

Select your IdP from the list below, and follow the instructions:

• Okta (SAML)

• OneLogin (SAML)

• Microsoft Entra ID (SAML)

2. Enable SAML in Settings

To enable baseline SAML functionality:

Enter SAML Connection Settings

1. Log in to Sysdig Monitor or Sysdig Secure as administrator and select Settings from the User Profile button in the left navigation.

2. Select Authentication.

3. Select the SAML tab.

4. Enter the relevant parameters (see table below) and click Save Settings.

Select SAML for SSO

1. Select SAML from the Enable Single Sign-On dropdown.

2. Click Save Authentication.

3. Repeat the enablement process for Sysdig Monitor or Sysdig Secure, if you want to enable it on both applications.

Configure SAML Single Logout

Sysdig supports SAML Single Logout (SLO).

SLO is a feature in federated authentication where Sysdig users can sign out of both their Sysdig session (Service Provider) and associated IdP (Identity Provider) simultaneously. SLO allows you to terminate all sessions established via SAML SSO by initiating a single logout process. Closing all user sessions prevents unauthorized users from gaining access to Sysdig resources.

SLO Process

When you initiate a logout, Sysdig sends a digitally signed logout request to the IDP. The IdP validates the request and terminates the current login session, then redirects you back to the Sysdig login page.

Configure IdP

1. Configure logout URLs:

   • Monitor: <base_URL>/api/saml/slo/logout

   • Secure: <base_URL>/api/saml/slo/secureLogout

2. Choose HTTP Redirect as the binding method.

   This option is an alternative to the HTTP POST method, which Sysdig does not currently support.

3. If your IdP mandates, upload the signing certificate for Sysdig. See Retrieving the Public Keys for more information.

Certain IDPs, such as Entra ID, don’t require uploading the public key.

Configure Sysdig

1. Log in to Sysdig Monitor or Sysdig Secure as an administrator.

   For on-prem deployments, log in as the super admin.

2. Navigate to Settings > Authentication, and select SAML under Connection Settings.

3. Enter the SAML configuration.

4. Ensure that Enable SAML single logout is toggled on.

5. Click Save Settings.

6. Ensure that you select SAML from the Enable Single Sign On drop-down.

Encrypted SAML response

Enabling encryption of SAML assertions adds an extra layer of security to your Single Sign On (SSO) authentication.

To enable encrypted SAML response:

1. Obtain the encryption certificate. See Retrieving the Public Keys) for more information on obtaining the key.

2. Upload the certificate to your IdP.

3. Enable encryption on IdP.

Retrieving the Public Keys

You can retrieve the public key from metadata.

You can obtain the metadata as follows:

• Monitor: <base_URL>/api/saml/metadata/{customerName}

• Secure: <base_URL>/api/saml/secureMetadata/{customerName}

Follow these instructions to find your {customerName}.

Two types of KeyDescriptor <md:KeyDescriptor> are provided:

• Signing certificate: <md:KeyDescriptor use=”signing”> - Used to sign the SLO request.
• Encryption certificate: <md:KeyDescriptor use=”encryption”> - Used to decrypt the encrypted assertions that we receive from the IdP.

If you are having issues retrieving the key, contact Sysdig Support to retrieve the public key associated with your deployment.

End User Login to Sysdig

As noted in the Basic Enablement Workflow above, you can offer users three ways to log in with a SAML configuration:

• They can begin at the Sysdig SaaS URL and click the SAML button.

  See SaaS Regions and IP Ranges and identify the correct Sysdig SaaS URL associated with your Sysdig application and region. For example, URLs of Monitor and Secure for US East are:

  Monitor: app.sysdigcloud.com

  Secure: secure.sysdig.com

  They will be prompted to enter a Company Name, so the Sysdig platform can redirect the browser to your IdP for authentication.

• You can provide an alternative URL to avoid the user having to enter a company name, in the format:

  Sysdig Monitor: <https://app.sysdigcloud.com/api/saml/> <COMPANY_NAME>

  Sysdig Secure: <https://secure.sysdig.com/api/saml/><COMPANY_NAME>?product=SDS

  Replace <COMPANY_NAME> with your company name.

  For other regions, the format is https://<region>.app.sysdig.com/api/saml/auth. Replace <region> with the region where your Sysidig application is hosted. For example, for Sysdig Secure in the EU, you use https://eu1.app.sysdig.com/api/saml/secureAuth.

• You can configure an IdP-initiated login flow when configuring your IdP. The users then select the Sysdig application from your IdP’s app directory and do not browse directly to a Sysdig application URL at all.

See User and Team Administration for information on creating users.