> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/use-cases/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/use-cases/misc/dependency-track-protect-with-eid-mfa-and-sso.md). # Dependency-Track - protect with eID MFA and SSO Authenticate to Dependency-Track, using Freja as the authentication method. ## Scenario In this use case there is one scenario: * **MFA authentication to Dependency-Track.**\ In this scenario you will login using your Freja eID.\ The integration between Dependency-Track and Integrity Access is based on OpenID Connect (OIDC). Dependency-Track is an analysis platform to identity and reduce risk in the software supply chain. **This scenario could easily be copied and modified to fulfill:** * **Using other MFA methods to authenticate to Dependency-Track, such as SITHS, EFOS, Freja, Norwegian ID-porten, Foreign eID (eIDAS), eduID, Suomi.fi, FIDO, OTP, Oath.** * **Perform user authorization lookups before letting the user through to Dependency-Track.** **Single-Sign-On (SSO) is enabled by default.** ## Prerequisite * FortifiedID **Integrity Access** current version installed * **Freja certificate**. To be able to communicate with Freja backend. * **Dependency-Track administration rights.** * **Host (DNS) name** of the Integrity service (external access) * **Outgoing TCP/443 communication.** To be able to communicate with Freja backend services. ## Configuration ### Download and add configuration Remember that this use case does not describe installation of the products. Products are expected to be installed in advance. 1. Download ZIP containing configuration for Access 1. Click [USE\_CASE\_LINK](https://share.fortifiedid.se/index.php/s/Z4SWse9tJcWAQWS/download) to download customer folder for Web. 2. Add **Integrity Access** configuration to your environment. 1. Rename the existing customer folder to customer\_ORG.\ Add the **customer** folder to your \\..\fortifiedid\web\ folder. ### Update the Dependency-Track configuration #### Create group for OpenID Connect * Login to Dependency-Track as an administrator * Select Administration->Access Management * Select OpenID Connect Groups * Create a new group called DTRACK\_FORTIFIED\_USERS. This group will be propagated from the OpenID Connect Provider. * Map the new group to one or more teams (which controls permissions). Example: #### Update OpenID Connect settings * Open the docker-compose.yml file * Add these environment variables to the apiservice container:\ ALPINE\_OIDC\_ENABLED: true\ ALPINE\_OIDC\_CLIENT\_ID: "dependency-tracker"\ ALPINE\_OIDC\_ISSUER: "https\://\/oidc/fidrealm" ALPINE\_OIDC\_USERNAME\_CLAIM: "preferred\_username"\ ALPINE\_OIDC\_TEAMS\_CLAIM: "groups"\ ALPINE\_OIDC\_USER\_PROVISIONING: true\ ALPINE\_OIDC\_TEAM\_SYNCHRONIZATION: true Change \ to the host name of your integrity instance. * Add these environment variables to the frontend container:\ OIDC\_ISSUER: "https\://\/oidc/fidrealm"\ OIDC\_CLIENT\_ID: "dependency-tracker"\ OIDC\_LOGIN\_BUTTON\_TEXT: "Logga in med Fortified ID" Change \ to the host name of your integrity instance. * Save and close docker-compose.yml ### Update the Integrity configuration to map your environment The downloaded folders contains all information needed. For example, a test certificate and metadata files are included.\ However, some data needs to be changed to map your environment. Also the http ports might need to be changed if they are not available in your environment. #### Integrity Access In this section we will look at parts of the configuration and add/replace data for your environment. In this use case we are using the globals concept which is using variables to easily replace data specific to an environment or if a value is used in many places just update it in one place. * Open the file customer/config/globals.json. Change according to the instructions below. 1. **base\_dir** 1. base\_dir is the top folder where data is located that you do not want to be overwritten by an upgrade. Update the **base\_dir** folder to map your installation. 1. For Windows the value should be:\ "base\_dir": "../customer" 2. For Docker, the value should be:\ "base\_dir": ".", ```json "base_dir": "../customer" ``` 2. **http** Update the http information to map your environment. This is the port that Integrity Web will use to host the SAML IdP service.\ ! The recommendation is to always use SSL to encrypt the communication to Integrity Web.
```json "http": { "http_port": 443, "http_use_ssl": true } ``` 3. **oidc** Update the oidc information to map your environment.\ oidc\_op\_address is the integrity host name, including https.\ rps.redirect\_uri should be changed to https and the name of your dependency-track host. Leave the uri unchanged. ```json "oidc": { "oidc_op_address": "https://", "rps": [ { "client_id": "dependency-tracker", "client_secret": "not_applicable", "redirect_uri": [ "https:///static/oidc-callback.html" ] } ] } ``` 1. **keystore - oidc**\ The keystore used to sign JWT identity- and access tokens.\ For test environments, you may use the test certificate provided by us, if so you do not need to change anything.\ For production environments, you should use your own keystore and update the values below to point to that keystore.
```json "keystore": { "oidc": { "keystore_path": "${globals.file_paths.base_dir}/config/resources_internal/certificates/fortifiedid.p12", "password": "password", "alias": "fortifiedidab" } } ``` Save the globals.json file. * Restart the Integrity web service and verify the start by looking through the server.log file. ### Restart dependency-track * Restart the dependency-track containers.\ docker compose down\ docker compose up -d ## Testing the use case 1. Browse to https\://\ and select *Logga in med Fortified ID* 2. You should be redirected to the OP (integrity access) 3. Authenticate with Freja 4. You should be redirected back to Dependency-Track with an authorization Code. 5. You should now be logged in to Dependency-Track. Check server.log file to find errors. Fix accordingly.