Rapid7 SAML Integration Guide

Suggest an edit

Prerequisites

  • Platform Administrator access to your Rapid7 organization
  • A SplitSecure Identity Provider created and approved
  • Access to the Rapid7 Command Platform Administration settings
  • A separate browser or browser profile with SplitSecure configured (for testing)

Rapid7 Configuration

1 Access SSO Settings in the Command Platform

  1. From the left menu of the Rapid7 Command Platform Home page, click the Administration link (gear symbol)
  2. In the left menu of the Administration page, click Authentication Settings
  3. Click the SSO Settings tab in the Authentication Settings section
  4. Click the Set up SSO button

2 Configure your SSO IdP

Fill the form with the following information:

  1. Under Select Identity Provider (IdP) Select Other.

  2. Under Add your IdP Certificate, upload the IdP certificate which can be found in SplitSecure at Secure Accounts → SAML2 Identity Providers → [Your IdP] → Details → Download Certificate (.pem).

  3. Under Copy the Following Data Into your External IdP, note the Relay State value—you will need this when configuring SplitSecure later.

  4. Under Provide the Required Fields From your IdP, enter the values found in SplitSecure at Secure Accounts → SAML2 Identity Providers → [Your IdP] → Details. Enter the following:

Rapid7 FieldSplitSecure Details page
Entity IDSAML IdP Entity ID
Single Sign-On Service URLSSO URL (POST)
  1. Under Default Access Profile, select the access profile that will be automatically assigned to users when they first log in via SSO. This determines their initial permissions within the Rapid7 platform.

IdP Group Synchronization (Optional)

Rapid7 supports IdP group synchronization, allowing automatic group assignment based on SAML assertions

  1. Create the required groups in Rapid7 first
  2. Enable IdP Group Synchronization in the SSO Settings

3 Save Configuration

Click Submit and turn on SSO to complete the Rapid7 SSO configuration.

4 Download Metadata File

  1. At the top right corner of the Single Sign-On (SSO) Settings card click Download
  2. The resulting file should be metadata.txt (despite being an XML file). Rename the file to have the extension .xml

SplitSecure Configuration

1 Create a Secure Account

  1. In SplitSecure, navigate to Secure Accounts → Create Account
  2. Select Rapid7 (or Generic SAML if Rapid7 is not listed)
  3. Enter a name for the account (e.g., Rapid7 Secure Account)
  4. Select your Identity Provider
  5. Upload the metadata XML file downloaded from Rapid7
  6. Enter the Relay State value copied from Rapid7
  7. Click Create Account

Test Authentication

1 SP-Initiated SSO (User starts at Rapid7)

  1. Navigate to https://insight.rapid7.com
  2. Click Sign in with SSO or enter your organization’s SSO domain
  3. You will be redirected to SplitSecure
  4. Authenticate with your SplitSecure credentials
  5. You should be redirected back to Rapid7, logged in

2 IdP-Initiated SSO (User starts at SplitSecure)

  1. Navigate to SplitSecure
  2. Go to Secure Accounts
  3. Click on your Rapid7 Secure Account
  4. Click Authenticate or Launch
  5. You should be logged directly into Rapid7

Troubleshooting

Issue Possible Cause Solution
User cannot authenticate User doesn’t exist and auto-provisioning disabled Enable auto-provisioning or create user manually in Rapid7
Certificate error Certificate mismatch or expiration Re-download the certificate from SplitSecure and update in Rapid7
Relay State error Relay State value mismatch Verify the Relay State value matches exactly between Rapid7 and SplitSecure
User assigned wrong access profile Default Access Profile misconfigured Update the Default Access Profile in Rapid7 SSO settings
Group memberships not syncing IdP Group Synchronization not enabled Enable IdP Group Synchronization and ensure groups exist in Rapid7 first
Locked out after SSO misconfiguration No local Platform Administrator retained Contact Rapid7 support; always retain at least one local admin account

External Resources