Step 1: Download
the metadata from DatadogDatadog is a monitoring service for cloud-scale applications, providing monitoring of servers, databases, tools, and services, through a SaaS-based data analytics platform (see https://www.datadoghq.com/). You can protect access to Datadog by integrating Datadog with Identity as a Service. Once integrated, users can use single sign-on to log in to their Datadog account through Identity as a Service.
Note: This integration was tested using Identity as a Service version 5.15 and Datadog Release March 1, 2021. Other versions of Datadog may require integration and configuration steps that differ from those documented in this procedure. For other versions of Datadog, this integration guide may be used as an initial approach for integrating Datadog. In the event of other issues, contact support@entrust.com for assistance.
Step 1: Download
the metadata from Datadog1. Log in to your Datadog administrator account. The Overview page appears.
2. Navigate to the bottom of the left-hand menu, select your username and click Configure SAML. The Settings page appears.
3. Under Datadog Service Provider Details, click the Service Provider Metadata link:
https://app.datadoghq.com/account/saml/metadata.xml
The metadata XML appears.
4. Right-click and select Save As.
5. Save the as Datadog-SP-metadata.xml.
Step
2: Add Datadog to Identity as a ServiceAdd Datadog as an application to Identity as a Service
1. Log into your Identity as a Service administrator account.
2. Click
> Security > Applications. The Applications
Lists page appears.
3. Click Add. The Select an Application Template page appears.
4. Do one of the following:
● Select SAML Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.
- or -
● In the Search bar, enter a search option to filter for the application you want to add to IDaaS.
5. Click Datadog. The Add Datadog page appears.
6. Enter an Application Name.
7. Enter an Application Description.
8. Optional. Add a custom application logo.
a. Click 
next to Application Logo. The
Upload Logo dialog box appears.
b. Click 
to
select an image file to upload.
c. Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.
d. If required, resize your image.
e. Click OK.
9. Select the Authentication Flow that appears to users during login.
10. Click Next. The General page appears.
11. Click
to the Upload Metadata XML
and browse to the location of the metadata file you downloaded
in Step 1: Download the metadata file from Datadog. The Metadata
Configuration dialog box appears.
a. If required, click Merge with existing values to merge new values with existing values for Alternative Assertion Consumer Services URLs and SAML attribute names.
b. Click Save.
12. In the Single Logout Service URL, enter
https://app.datadoghq.com/account/logout
13. Enter the SAML Session Timeout to the time when the SAML Assertion times out. The maximum is 720 minutes.
14. Enter the Max Authentication Age (seconds) to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.
15. From the SAML NameID Attribute drop-down list, select Email.
16. From the SAML NameID Encoding Format drop-down list, select Email.
17. From the SAML Signing Certificate drop-down list, select the signing certificate.
18. Select Sign Complete URL Response.
19. Optional: Select Respond Immediately for Unsuccessful Responses to return to the application immediately after a login failure, rather than allow user to try again with a different userID.
20. Deselect Enable Go Back Button if you do not want users to be able to go back to the Datadog login page to log in.
21. Select Show Default Assertion Consumer URL Service in the My Profile. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.
22. Optional. Select Encrypt SAML Assertion. If you select this option, do the following:
a. From the Encryption Method for Key drop-down list. select RSA-OAEP.
b. Click
Encryption Certificate File
and browse to select the Datadog certificate file used to encrypt
the SAML assertion.
23. Optional. Add Alternative Assertion Consumer Service URLs, as follows:
a. Click Add.
b. Enter a Name.
c. Enter a URL Value.
d. Select Show in My Profile to display the Alternative Consumer Service URL in a user's My profile page.
e. Optional. Add an Application Logo.
f. Click Add.
g. Repeat these steps to add more Alternative Assertion Consumer Service URLs.
24. Under SAML Attributes complete the following:
Add a Last Name attribute:
a. Click urn: oid:2.5.4.4. The SAML Attributes dialog box appears.
b. Click Add next to Value(s).
c. In the Values field type < and select <Last Name> to include a user's last name every time the user authenticates to the application.
d. Click Edit.
Add a First Name user attribute.
a. Click urn: oid:2.5.4.42. The SAML Attributes dialog box appears.
b. Click Add next to Value(s).
c. In the Values field type < and select <First Name> to include a user's first name every time the user authenticates to the application.
d. Click Edit.
Add an Email user attribute.
a. Click urn: oid:1.3.6.1.4.1.5923.1.1.1.6. The SAML Attributes dialog box appears.
b. Click Add next to Value(s).
c. In the Values field type < and select <Email> to include a user's email every time the user authenticates to the application.
d. Click Edit.
25. Click Submit.
Step
4: Download the Metadata from Identity as a ServiceDownload the Metadata file from Identity as a Service
1. In Identity as a Service, click
> Security > Applications.
The Applications List page appears.
2. Do one of the following:
● Click
next to the application you are integrating
with Identity as a Service.
–or–
● Click
next to the application you are integrating
with Identity as a Service and select SAML IDP Metadata.
The SAML Application Metadata dialog box appears.
3. Select the certificate to include in the SAML IDP Metadata file from the drop-down list.
4. If applicable, Select the domain to include in the SAML IDP Metadata file from the drop-down list.
5. Enter the Lifetime, in days, for the SAML IDP Metadata file. The value must be between 2 and 730.
6. Do one of the following, as required:
a. Copy the Public Endpoint to paste into your SAML application being used Identity Provider authentication.
b. Click Download.
Note: If you are using multiple domains, you must download each domain's metadata file separately because the values in the metadata file vary for each domain.
Step
5: Configure Datadog for Identity as a Service single sign-on1. Log in to your Datadog administrator account.
2. Navigate to the bottom of the left-hand menu, select your username and click Configure SAML. The Settings page appears.
3. Under Start by uploading your Identity Provider (IdP) metadata, click Choose File and browse to open the metadata file you downloaded in Step 4: Download the metadata from Identity as a Service.
4. Click Upload file. A SAML is ready option appears.
5. Click Enable. The Single Sign-On URL appears.
6. Scroll to Additional Features.
7. Select Identity Provider (IdP) Initiated Login.
8. Click Save.
Step 6: Test
the integrationTesting Service Provider Login
1. Open a Web browser and enter the URL for your Datadog account. You are directed to Identity as a Service.
2. Enter your Datadog account User ID and click Next.
3. Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to the Datadog.
Testing Identity as a Service redirect log in
1. Log in to your Identity as a Service account.
2. Go to your My Profile page if you are not already there.
3. Under Applications, click Datadog.
4. Respond to the second-factor authentication challenge. If you respond successfully, you are logged into Datadog.