Forcepoint ONE SSE Deployment Guide Document Subtitle

Home
Integrate identity
You can configure user identity settings and synchronize user information from your directory in order to assign policies to users or groups.
Authenticating users
Forcepoint ONE SSE enables you to enforce user authentication using any one of the three methods.
Adding external IdPs in Forcepoint ONE SSE
You can configure various applications to support Forcepoint ONE SSE as a SAML Service Provider.

Verify access and perform initial configuration
Describes about initial account configurations, such as creating and assigning administrator accounts and roles, and configuring portal access and timeout policies in Forcepoint ONE Security Service Edge.
Integrate identity
You can configure user identity settings and synchronize user information from your directory in order to assign policies to users or groups.
- Provisioning users
  Prior to an end user being able to use Forcepoint ONE SSE, the user must exist within the portal under the IAM > User and Groups page.
- Authenticating users
  Forcepoint ONE SSE enables you to enforce user authentication using any one of the three methods.
  - Adding external IdPs in Forcepoint ONE SSE
    You can configure various applications to support Forcepoint ONE SSE as a SAML Service Provider.
    - ADFS: Configuring Forcepoint ONE SSE as a SAML SP
      You can configure Active Directory Federation Services (ADFS) to support Forcepoint ONE SSE as a SAML Service Provider.
    - Okta: Configuring Forcepoint ONE SSE as a SAML SP
      You can configure Okta to support Forcepoint ONE SSE as a SAML Service Provider. Admin can use the registered application available in Okta for easy configuration.
    - PingOne: Configuring Forcepoint ONE SSE as a SAML SP
      You can configure PingOne as an external IdP inside of Forcepoint ONE SSE.
    - PingFederate: Configuring Forcepoint ONE SSE as a SAML SP
      You can add PingFederate to Forcepoint ONE SSE as a third party IdP.
    - DUO: Configuring Forcepoint ONE SSE as a SAML SP
      You can configure Forcepoint ONE SSE as a SAML SP for DUO. DUO typically provides both, two factor authentication and Identity Provider (IdP) services. Forcepoint ONE SSE can point to any IdP for user authentication and account creation.
    - OneLogin: Configuring Forcepoint ONE SSE as a SAML SP
      You can setup OneLogin as an IdP in Forcepoint ONE SSE for authentication.
    - Cyberark Idaptive: Configuring Forcepoint ONE SSE as a SAML SP
      You can add Cyberark Idaptive as an external IdP via SAML SSO integration with Forcepoint ONE SSE. Forcepoint ONE SSE offers both IdP-initiated SAML SSO (for SSO access through the user portal or Idaptive mobile applications) and SP-initiated SAML SSO (for SSO access directly through the Forcepoint ONE SSE web application). You can configure Forcepoint ONE SSE for either or both types of SSO. Enabling both methods ensures that users can log into Forcepoint ONE SSE in different situations such as clicking through a notification email. Refer to the Cyberark's documentation for more information.
    - Microsoft Entra ID: Configuring Forcepoint ONE SSE as a SAML SP
      You can set up Microsoft Entra ID as an IdP within Forcepoint ONE SSE. This setup will work to configure SAML SSO proxy authentication with any apps outside of Microsoft apps.
    - Any SAML IdP: Configuring Forcepoint ONE SSE as a SAML SP
      Use the configuration information to register Forcepoint ONE SSE as a SAML SP on other external SAML IdP.
  - Using advanced IdP settings
    Use the additional information that may be needed during your IdP setup that is not covered in the primary setups, such as Default Relay State.
  - Configuring ACS Proxy
    This section describes how to configure ACS Proxy in Microsoft 365, Microsoft Entra ID and Okta.
- Provisioning new domains
  You can provision as many email domains as you wish to add into the Forcepoint ONE SSE system. Every email domain that you wish to use within Forcepoint ONE SSE must be configured, along with a corresponding authentication type for users logging in with email addresses in that domain.
Configure common components
Describes how to configure common components such as login policies, various notifications, custom notification files and so on.
Setup traffic steering
Forcepoint ONE SSE supports SmartEdge Agent and Cloud SWG traffic steering methods. This chapter describes steps to deploy each of those so that traffic can be forwarded to Forcepoint ONE SSE.
Configure DLP
DLP is a data loss prevention capability that allows for pattern matching (via regular expressions and keywords) against data as it is either being downloaded, uploaded, or scanned via API at rest.
Configure Zero Trust Network Access
Forcepoint ONE SSE's Agentless and Agent-based Zero Trust Network Access (ZTNA) provides an alternative to VPNs allowing admins to provide inline protection to internal apps without the need for VPN service to be running on the user's local machine.
Protect cloud applications
This chapter describes how to setup various cloud applications in Forcepoint ONE SSE so that Admins can monitor the data at rest and data in motion.
Configure policies
Describes how to configure policies for your application in Forcepoint ONE SSE portal so that you can monitor the data at rest and data in motion.
Monitor and analyze traffic
You can perform steps to monitor and analyze the traffic. Forcepoint ONE SSE Log Export REST API allows customers to query and pull cloud and access Logs. Alternatively, customers with Splunk or QRadar can instead utilize the Forcepoint ONE SSE Splunk app or the Forcepoint ONE SSE QRadar App for easy integration with the Forcepoint ONE SSE REST API to extract Forcepoint ONE SSE logs.
Configure applications
Forcepoint ONE SSE supports various cloud applications so that Admins can monitor data which is in transit, in motion and at rest.

Adding external IdPs in Forcepoint ONE SSE

You can configure various applications to support Forcepoint ONE SSE as a SAML Service Provider.

ADFS: Configuring Forcepoint ONE SSE as a SAML SP
You can configure Active Directory Federation Services (ADFS) to support Forcepoint ONE SSE as a SAML Service Provider.
Okta: Configuring Forcepoint ONE SSE as a SAML SP
You can configure Okta to support Forcepoint ONE SSE as a SAML Service Provider. Admin can use the registered application available in Okta for easy configuration.
PingOne: Configuring Forcepoint ONE SSE as a SAML SP
You can configure PingOne as an external IdP inside of Forcepoint ONE SSE.
PingFederate: Configuring Forcepoint ONE SSE as a SAML SP
You can add PingFederate to Forcepoint ONE SSE as a third party IdP.
DUO: Configuring Forcepoint ONE SSE as a SAML SP
You can configure Forcepoint ONE SSE as a SAML SP for DUO. DUO typically provides both, two factor authentication and Identity Provider (IdP) services. Forcepoint ONE SSE can point to any IdP for user authentication and account creation.
OneLogin: Configuring Forcepoint ONE SSE as a SAML SP
You can setup OneLogin as an IdP in Forcepoint ONE SSE for authentication.
Cyberark Idaptive: Configuring Forcepoint ONE SSE as a SAML SP
You can add Cyberark Idaptive as an external IdP via SAML SSO integration with Forcepoint ONE SSE. Forcepoint ONE SSE offers both IdP-initiated SAML SSO (for SSO access through the user portal or Idaptive mobile applications) and SP-initiated SAML SSO (for SSO access directly through the Forcepoint ONE SSE web application). You can configure Forcepoint ONE SSE for either or both types of SSO. Enabling both methods ensures that users can log into Forcepoint ONE SSE in different situations such as clicking through a notification email. Refer to the Cyberark's documentation for more information.
Microsoft Entra ID: Configuring Forcepoint ONE SSE as a SAML SP
You can set up Microsoft Entra ID as an IdP within Forcepoint ONE SSE. This setup will work to configure SAML SSO proxy authentication with any apps outside of Microsoft apps.
Any SAML IdP: Configuring Forcepoint ONE SSE as a SAML SP
Use the configuration information to register Forcepoint ONE SSE as a SAML SP on other external SAML IdP.

Copyright © 2024 Forcepoint LLC