Access Control - Settings Tab (v2.0 and up)

Host (Outgoing Mail Server) *

Enter the name or IP address of the outgoing mail server.

Port *

If you are not using the default SMTP port 25 (if encryption is not used), you can change the SMTP port value.

Encryption Type

SSL – Enable SSL to ensure the connection to your mail server is encrypted and secure.

TLS – Enable TLS for a more advanced and secure version of SSL.

None – to connect to your mail server without encryption

Send from address *

Enter the address that will send the email (e.g., [email protected]).

User default credentials

Check to use the default credentials.

User Name and Password

Optionally, enter the SMTP user name and password for your pre-configured SMTP server account.

Send Test Email

Once the settings are defined, use this option to validate the connection. Validation is performed by sending and receiving a test email.

Domain Name

The (short) domain name

DNS Domain

The Fully Qualified Domain Name (FDQN)

Add

Click to add a new domain.

Name*

Enter the short domain name, which can be determined by running “Echo %userdomain%” in the command prompt.

DNS Domain*

Enter the Fully Qualified Domain Name (FDQN), which can be determined by running "echo %userDNSdomain%" in the command prompt.

For editing the domain.

Click the icon and edit as needed, then click UPDATE.

To remove the domain.

Click the icon, then on the confirmation message, click REMOVE.

Enable LDAP Server

Toggle to enable/disable the LDAP server.

NOTE: Disabling the LDAP server will prevent the users of this LDAP server from logging into the system. It will still be possible to manually add users and map LDAP groups to roles.

Server name *

Enter the name of the LDAP server.

NOTE: This name will also be used on the login page.

Host name *

Enter the LDAP server hostname.

For exampl*e: ldap.company.com

Port *

Enter the LDAP server port.

For example: 389, 636 (for SSL)

User name & Password *

Enter the credentials of the binding user (LDAP bind username and bind password).

NOTE: The user needs at least read permissions to the LDAP directory.

The username can be in the following formats: <domain\username> or <username@domain> or <full user DN>

For example: [email protected] or cn=user,dc=domain,dc=name

Use SSL

Check this to connect to the LDAP server using SSL encryption.

Verify SSL certificate

Check this to verify the SSL certificate.

NOTE: If you use an untrusted certificate, you can cancel the certificate verification to pass the connection. SSL will still be used, and the network will be encrypted.

Directory Type *

Select from the options Active Directory, Open LDAP, Custom LDAP Server.

Server attributes are automatically populated according to default settings.

Enable SSO

NOTES:

Domain *

Select a Windows domain to map the LDAP server to.

NOTES:

Base DN *

The LDAP root node for searching users.

Additional User DN

Limits user search to specific DN (to optimize the search time). The additional user DN is appended to the base DN.

NOTE: Do not repeat the base DN in this field.

User Object Class *

The LDAP user object class type to use when loading users.

User Object Filter *

The filter expression to use when searching user objects.

Username Attribute *

The attribute field to use on the user object

User First Name Attribute *

The attribute field to use when loading the user’s first name.

User Last Name Attribute *

The attribute field to use when loading the user’s last name.

User Email Attribute *

The attribute field to use when loading the user’s email

Synchronization enabled/disabled

If synchronization is disabled, users must be created manually (via Import from Directory only), as there is no information about roles and teams to create them.

Enabling synchronization enables the creation of new LDAP users who will be automatically assigned to roles and teams according to their LDAP mapping.

NOTE: If synchronization is disabled, login can only be performed using existing LDAP users. If synchronization is enabled, a user can easily log in with only a name and password.

ROLE AND TEAM MAPPING

Enables defining the default role(s) and team(s) to be assigned to newly-created LDAP-based users.

Default Role & Default Team *

Define the default role and team assigned to newly created, LDAP-based users.

NOTE: A default team (but not a default role) must be selected when synchronization is enabled. In the Hierarchy tree, you can search for a specific team by any string within the team information (see Hierarchy Tree Team Search).

These defaults (for Role and Team) will be used if no Advanced Team and Role Mapping are defined for a current user trying to log in.

Automatically update user role and team upon login

If checked, a user’s role and team will be automatically updated upon login, according to default or Advanced Team and Role Mapping.

NOTE: If this feature is not checked, a user's details will only be updated once – at the first login.

Periodically sync user availability

If checked, then every 24 hours, all LDAP users (usernames) deleted from the LDAP server will be deactivated in Access Control (therefore freeing up those licenses).

A red indicator next to a user’s name (on the list of users – User’s tab) indicates the user has been deactivated:

NOTE: If the connection to the LDAP server fails, the deleted users will not be deactivated in Access Control.

Advanced Team and Role Mapping

Enables mapping roles and teams to LDAP groups.

Enables a user’s role to be set according to specific LDAP group DNs automatically. Enables the user to automatically be assigned to a team according to LDAP mapping configuration (see here > LDAP Group Mapping).

Enable Default Team

When advanced Team and Role Mapping is enabled – it enables or disables Default team mapping.

Enable Default Role

When advanced Team and Role Mapping is enabled – it enables or disables Default role mapping.

GROUP SCHEMA SETTINGS

Enables defining the search of LDAP groups that can be mapped to teams (see here > LDAP Group Mapping).

Additional Group DN

[Optional]: The Additional Group DN (appended to the Base DN) reduces the search scope to a specific DN when searching for groups.

NOTE: Do not repeat the Base DN in this field.

Group Object Class

Used for team mapping, it defines the group object class and limits group searching to a specific DN.

NOTE: Required if Synchronization and Advanced Team and Role Mapping are enabled.

Group Object Filter

Used for team mapping, Group Object Filter is an LDAP filter expression for use when searching groups.

NOTE: Required if Synchronization and Advanced Team and Role Mapping are enabled.

Group Name Attribute

Used for team mapping, Group Name Attribute is an attribute in LDAP defining a group’s name.

NOTE: Required if Synchronization and Advanced Team and Role Mapping are enabled.

MEMBERSHIP SCHEMA SETTINGS

Enables defining the attributes that associate the LDAP users with their assigned teams.

Group Members Attribute (member)

An LDAP member attribute, which is multi-value, contains a list of unique names for users in the team (user DNs), as well as group and contact objects that are members of the group.

It is used to determine the logged-in user groups to perform the right mapping to roles and teams.

NOTE: Required if Synchronization and Advanced Team and Role Mapping are enabled.

User Membership Attribute (memberOf)

An LDAP memberOf attribute, which is multi-value, contains all the groups the current user is a member of (group DNs).

If designated, this attribute replaces the Group Members Attribute for determining the logged-in user groups (taking the groups the user belongs to straight from the user entry instead of searching inside every group).

ADVANCED ROLE MAPPING

Define what role(s) the users in specific LDAP group(s) will be assigned (mapped) to. Multiple roles can be assigned to the same LDAP Group DN.

1. Click Edit Advanced Role Mapping.

2. Click the arrow in the Cx Role field and select a role from the options.

3. In the LDAP Group DN field, use a semicolon to separate multiple group entries.

Examples: cn=dev;ou=grp;dc=my;dc=org;cn=qa;ou=grp;dc=my;dc=org

4. Repeat this procedure for each LDAP group—role mapping.

5. Click Update.

ADD NEW / EDIT SAML IDENTITY PROVIDER (IdP)

Configure one or more new SAML identity providers in the system. SAML will be used as a single sign-on login and can be configured for user authentication, team, and role mapping.

Enable SAML

Toggle to enable/disable SAML.

Identity provider display name

Enter the display name of the SAML IDP server.

Example: CxSAML

Issuer (identity provider)

The unique identifier of the IDP is usually contained in the URL of the IdP.

In certain SAML implementations, it is called “entity Id.”

This parameter is provided by the IdP setup information under ‘Identity Provider Issuer’.

Example:https://srvl.idpname.com/mypageUnlink

Single Sign-On URL

The IdP login location to where SAML requests will be sent.

This parameter is provided by the IdP setup information under ‘Identity Provider Single Sign-On URL'.

Example:https://srvl.idpname.com/app/checkmarxdev/sso/saml

Logout Redirect URL

The location to where logout instances will be redirected.

Example:https://srvl.idpname.com/apps

Error Redirect URL

The location to where error instances will be redirected.

IdP Certificate File

This is the public key (X.509 certificate) from the IdP Setup instructions under ‘Download Certificate'.

The certificate will be used to validate the SAML assertion from the IDP.

Browse

Browse for the IdP certificate file location and navigate to the IdP certificate file (.cert) downloaded from the Identity Provider Setup instructions.

Sign SAML AuthnRequest

Select to sign the SAML AuthnRequest.

Request Binding

Click the Request Binding dropdown arrow and select the SAML binding protocol to use when sending the request: HTTP-Redirect or HTTP-Post

USER AUTHORIZATION MANAGEMENT

Presents two options to select from – if the user authorization teams and roles will be controlled by the SAML Identity Provider or by the Access Control Application.

Application Authorization

By selecting this option, SAML users will be getting the default role and default team (as defined in the Default Role and Default Team fields)

Default Role

Click the dropdown arrow and select the default role assigned to newly created SAML-based users.

Default Team

Click the SELECT button, and then click on a team name in the window that displays. Then click SELECT TEAM.

IdP Authorization

By selecting this option, teams, and roles managed by the SAML Identity Provider are automatically updated upon login to CxSAST/CxOSA. The definitions for the update are defined during the creation and mapping of user attributes in the SAML IDP.

When the IdP Authorization option is selected, upon user login, all the teams and roles manually assigned within Access Control (via the Application Authorization option) will be overwritten with the SAML-defined teams and roles.

NOTE: The teams and roles assigned per user in the SAML IDP must exist in CxSAST before the assignment. Otherwise, the user won't be assigned those teams/roles, and the user won't be able to log in to Checkmarx products.

SP Certificate File

The certificate will be used to sign the SAML request (default provided).

Browse

You can browse to another SP Certificate file – but only upload P12 or PFX certification file formats that contain a private key.

Password

The SP Certificate file password.

Issuer (Service provider)

The unique identifier of the Service Provider (e.g., http{s}://{server}:{port}). The field must contain a valid, fully-qualified HTTP or HTTPS URL.

NOTE: The provided default value can be changed.

Download Metadata

For downloading the Access Control SP metadata configuration. This file (Cx_SAML_Metadata) can be uploaded to the IdP for easier configuration of the Access Control SP.