Creating a new user (Open Source)
This page describes the recommended onboarding workflow for adding new users to a DefectDojo instance. DefectDojo users can be used as both standard, human-operated accounts and as service accounts.
The admin who creates the account is responsible for delivering the initial credentials (username and password) to the new user.
Recommended workflow
Create the user account in DefectDojo (Superuser only):
- Navigate to ๐ค Users โ Users to open the All Users table.
- Click the ๐ ๏ธ (crossed wrench and screwdriver) icon.
- Enter the new user’s name and email address.
- Set a temporary password.
- Submit the form.
Assign permissions as appropriate โ Asset/Organization membership, Configuration Permissions, Global Role, or Superuser status. See Set a User’s permissions for details. A new user with no assignments will not be able to see any Assets or Findings.
Send the credentials to the new user out-of-band (over email, your team’s chat tool, or however you normally share secrets). Include:
- The DefectDojo instance URL.
- The username (typically their email address).
- The temporary password you just set.
- A note that they should change the password on first login.
The new user logs in and rotates the credential. They can either:
- Log in with the temporary password and then change it from their profile menu, or
- Use the I forgot my password link on the login page to set a password directly without using the temporary one. The temporary password is still required for the initial account record to exist, but the user does not need to remember it if they use the password-reset flow.
SSO Users
If your instance is configured with SSO, the workflow is different โ users are typically created on first login from the Identity Provider, and you only need to grant them group membership or roles afterwards.
If you have moved to open-source DefectDojo (where SSO is Pro-only) and existing SSO users can no longer log in, see Re-enabling login for SSO users.