Dynatrace SAML Integration in Cloud Environment

This document explains how to implement Monosign with Dynatrace. It covers Single Sign-On using SAML, where Monosign acts as the Identity Provider (IdP) and Dynatrace as the Service Provider (SP).

Instructions

This documentation contains 5 main steps for integration.

1. Creating an Application on Monosign

2. Configuration Single Sign-On for Dynatrace

3. Assign a user to the Dynatrace application

4. Sign In Test

5. Troubleshooting

1- Creating an Application on Monosign

Create your application on Monosign and configure your access policy. Once you create, click "Keys" and add a new Access Key for SAML Key for access.

Import the metadata XML file from the Dynatrace configuration settings.
(Heading 2 – Image 3 – “Download SP Metadata” button)

We will need this information while we configure the Dynatrace federation.

Configuration details for the Dynatrace application are provided as follows:

Change ACS (Assertion Consumer Url), Entity Id, NameId Format, Name Id and Extra Attributes. Use the values shown on the Dynatrace federation screen (see step 2).

⚠️ Dynatrace compares the e-mail address entered on the sign-in screen with the identity returned by the IdP. Name Id must be the user's e-mail address, not the username, otherwise the login is rejected with a 400 error (see Troubleshooting).

To ensure that the application has access to user groups, follow these steps:

1. If the application hasn't been configured yet, click the "Edit" option for the application.

2. In the application settings, navigate to the "Source, Provider, and Profile" tab.

3. Configure the "User Access Type" and "User Group Access Type" as "Only Assigned Users."

2- Configuration Single Sign-On for Dynatrace

In Dynatrace, open Account Management and start a new SAML federation. When asked for the federation type, select Account federation.

Enter the IdP details from the Monosign application key created in step 1 (Sign On Service, Logout Service and View Certificate / Download Certificate), or upload the Monosign SAML metadata if Dynatrace asks for it.

Dynatrace creates users on their first successful SAML login, but permissions are granted through groups. Create a group under Identity & access management > Groups, assign a policy to it and scope the policy to the environment the users should reach.

If the group attribute is not sent by Monosign, either add the user to a group manually from Account Management > Users after the first login, or grant the permission to the built-in Default group with all users as described below.

Dynatrace Permission Settings

A user created by SAML has no permissions until a group with a policy applies to them. Without one, the first login ends with a 403 You don't have permission to view this page error. The quickest way to give every federated user access is to attach a policy to the built-in Default group with all users (group type ALL_USERS). Every user in the account is a member of this group automatically, so no group attribute has to be sent by Monosign.

Open the default group

1. In Dynatrace, open the menu in the top-left corner and go to Identity & access management > Group management (marked 1 in the screenshot).

2. In the group list, click Default group with all users (marked 2). The other built-in groups (Account Admins, Account Viewers, Environment Admins, Environment Users, Environment Professionals) can be used for role-based access, see the note below.

Add the permission

3. On the View group Default group with all users page, find the Permissions section and click the + Permission button on the right side.

4. In the permission list, select the Standard User policy and set its scope to your Dynatrace environment.

5. Save. The Permissions table now shows the new entry, as in the screenshot below.

After saving the permission, ask the user to sign out of Dynatrace and sign in again. Permissions are only evaluated at login.

3- Assign a user to the Dynatrace application

Please follow below instructions on how to assign a user to the Dynatrace application. Give the user access from the application's Access tab, and make sure their Monosign profile has Email filled in. The e-mail must be exactly the address the user types on the Dynatrace sign-in screen.

4- Sign In Test

Now try to login. Navigate to the Dynatrace sign-in page and enter your e-mail address. You will be redirected to the Monosign login page. Log in passwordless with your QR code or with your username and password.

Once authenticated, you will be redirected back to Dynatrace as the mapped user. If the user does not belong to a group with a policy yet, Dynatrace shows a 403 page; add the user to the group (or apply the permission to the default group, see Dynatrace Permission Settings) and sign in again.

5- Troubleshooting