Forest Global Training Partners

Cyber Risks · PortSwigger Research

Enabling Burp Suite DAST to access your ADFS groups - Port Swigger

Summary: PortSwigger's guidance describes how Burp Suite DAST can map its local groups to ADFS groups when SCIM is not in use, either through a central claim issuance policy or through claim rules configured group by group. A central policy sends all of a user's groups with every claim and applies automatically to new groups but requires the Active Directory group names to be kept exactly, while per-group rules allow a different output name, such as "Scan viewers" for BSEE_View_Scans, but must be repeated for each new group.

What you should know: Group names in Active Directory become the thing that decides what a user can see and do in Burp Suite DAST, so a naming mismatch or a missed claim rule for a newly added group can leave access either too broad or silently broken.

Read the original at PortSwigger Research ↗

Topics
Identity & Access Management
Related