SAML / SSO

Vulnotes supports SAML 2.0 for single sign-on integration with enterprise identity providers like Okta, Azure AD, OneLogin, and others.

Configuration

Go to Administration > Settings > Authentication and enable the SAML provider. You will need:

• IdP Entity ID - the identifier of your identity provider
• IdP SSO URL - the login URL provided by your IdP
• IdP Certificate - the X.509 certificate from your IdP for signature verification

On the IdP side, configure Vulnotes as a service provider using the callback URL shown in the settings page.

Attribute mapping

Map SAML assertion attributes to Vulnotes user fields. The most common attributes are:

• Email address
• Display name
• First and last name

Auto-provisioning

When a user logs in via SAML for the first time, Vulnotes automatically creates their account with the default role. Administrators can then assign specific roles and teams as needed.

Login flow

When SAML is enabled, users see an SSO button on the login page. Clicking it redirects to the identity provider where they authenticate. After successful authentication, they are redirected back to Vulnotes with an active session.