---
title: Authentication
slug: docs/authentication
docTags: 
createdAt: 2024-05-13T22:13:55.786Z
---

## Default

The default authentication method for TruffleHog uses Google Oauth or Magic Links for user management. 

Each user must be added by email on the Users page by an administrator before they can log in. This applies when **Require SSO login with automatic role mapping** is disabled.

## SSO Authentication 

To use JIT (Just-in-Time) provisioning, which automatically creates user accounts upon first login, you must enable **Require SSO with Automatic role mapping.**

**Note**: This does not require a user account be created on the TruffleHog instance first. 



![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/Vz_qz5Peypi2fD9hAel5O_image.png)

## SAML SSO

Authentication can be configured to be handled by a SAML SSO identity provider (IdP). When this option is enabled, the IdP is responsible for user management.

### Okta Configuration

1. Select “Create a new app integration”

   ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/ntUhQXnFSFJqKotOJ9ezO_image.png "Adding new app integration")
2. Select a “SAML 2.0” app

   ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/Ic3mGDZIFIiIz8XX9U4jy_image.png "Select SAML 2.0 app")
3. Set your app name and app logo

   ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/E_KXd0ZyV6VJS2aV6qMPy_image.png "Define the app tile")
4. Single Sign on URL → See Authentication page in TruffleHog dashboard

   ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/HgMexprMV1M5SykghHwXK_image.png "Copy the ACS URL")
5. Single sign on URL → See Assertion Consumer Service (ACS) URL on Authentication page under Settings.
6. Audience URI → Base URL for your TruffleHog deployment. For example, if your ACS URL is `https://sample-instance.trufflehog.org/saml/acs`, your Audience URI will be `https://sample-instance.trufflehog.org`
7. Name ID Format → EmailAddress
8. Add the following Attribute Statements
   1. email → user.email
   2. firstName → user.firstName
   3. lastName → user.lastName

      ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/cI0w-WerghhasJxI7W5Lg_image.png "Fill in the required fields")
9. Complete setup
10. Go to the new app admin page
11. Go to Sign On tab
12. Open “View SAML setup instructions”

    ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/QaxYLdEUYUY--V6ok0b_t_image.png "Find the SAML setup instructions")
13. Select the IDP metadata from the text box

    ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/yrFIYO2MlzT8X9x7OVfEN_image.png "Copy the IDP metadata URL")
14. Paste the metadata content into the metadata field on the TruffleHog authentication configuration page

### Azure Configuration

1. Go to Enterprise Applications, and select "New Application"

   ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/gJVqEKCe2PLCo8no66o9W_image.png "Create a new application")
2. Select "Create your own application"

   ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/oxpyk4JK-Y97ltI8Tj5Lu_image.png "Select Create your own application")
3. Enter the name of your application, and click Create
4. Go to Single sign-on, and select SAML

   ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/YcXUcaOx1XUff-hhUVJFv_image.png "Select SAML method")
5. Edit Basic SAML Configuration
   1. Set Identifier to Audience URI from TruffleHog Authentication Page
   2. Set Reply URL to ACS URL from TruffleHog Authentication Page
   3. Save
6. Go back to Single sign-on, and copy the App Federation Metadata Url and paste the Metadata URL in TruffleHog Authentication Page

   ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/gVCP478YjfmQK0tpfEqtA_image.png "Copy the metadata URL")
7. Edit Attributes & Claims and add the following:
   1. username: user.mail
   2. email: user.mail
   3. firstName: user.givenName
   4. lastName: user.surname

      ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/6SSyPkYpXuPj4Q4RrJp6N_image.png "Define the attributes and claims")
8. Add users or groups to your application

   ![](https://api.archbee.com/api/optimize/S23bFlGfp3a-8_a9YY_cE/DKzuxa6LZl8pwcNOGxokN_image.png "Add users or groups")

### Additional Notes

- If you are using an IdP that uses a subject that is unique for each session, add a 'username' attribute/claim that returns the user's email address.
- TruffleHog's Service Provider metadata endpoint can be found at `/saml/metadata` for your deployed instance. For example, if your instance is `https://sample-instance.trufflehog.org`, the Service Provider metadata endpoint is `https://sample-instance.trufflehog.org/saml/metadata`.
- You can use [Dynamic Role-Based Access Control (RBAC)](docId\:YBHiV5fvtb0lxnM6itD5H) to control JIT provisioning based on a user's group membership or other attributes sent by the IdP.