DefectDojo v3 - A New Chapter for the OWASP Edition

[devGregA]

DefectDojo Community, attached is an important update on the v3 release (now officially slated for this June) and what to expect with the new version.

DefectDojo v3 - A New Chapter for the OWASP Edition.pdf

[StefanFl]

I built RBAC for the DefectDojo community; it's really sad to see it disappear behind a paywall.

[devGregA]

Hi Stefan, good to hear from you, I hope you're doing well. Authorization in v3 is a new system built around custom roles. v2 remains open source and available to the community, unchanged.

Choosing not to support RBAC and SSO in v3's OWASP Edition comes down to making sure the platform endures. It was the option that affected the fewest users while making the platform easier to maintain: supporting integrations with identity systems we don't control or have access to is resource intensive. The full details are in the letter above.

Non-enterprise teams that qualify can apply for a free tier of Pro, which includes SSO and RBAC up to 2,000 findings, plus cross-tool deduplication, root cause analysis with correlation, threat intel, reachability, auto-remediation, the new UI, astronomical performance gains, the list goes on. For most of the community that's more than the OWASP Edition offered before. Anyone impacted is welcome to reach out to hello@defectdojo.com, and I remain open to helping directly.

[cpriyakant]

Without RBAC people will stop using this for sure.

[KarstenSiemer]

I second that. Pretty sad to see...
Especially as the project committed to not remove such features from the oss version like stated in #9628
Without simple sso, I really dont see any use case for this oss version

[NicolaiOksen]

This is just so sad. Removing a feature like SSO... Another great tool dies to the SSO Tax.

[kingsixty]

Getting rid of OIDC? not sure how that results in "making the platform easier to maintain". What it does, is it makes your platform easier to leave. We like this product, it sits in a sweet spot covering use cases that other products don't cover. But now you have turned it into a Brick. So sad.