Setting user authentication

The User Authentication option will allow admins to control how users are prompted to login to the agent for applying policy controls.

Auto-login uses the User-SID mapping available from Active Directory (AD) sync to login the user automatically. To use the Auto-login options with Microsoft Entra ID users, you first need to update the ObjectSID for the users. Refer to SmartEdge Agent with non-English Entra ID users.

There are 4 options available

• Auto-login, Anonymous: Upon installation, the SmartEdge agent immediately attempts to match the logged-in Windows user's SID with a user in the Forcepoint ONE SSE's IAM database.
  • If there is a match between the Forcepoint ONE SSE user's SID and the Windows user's SID, the Windows user is automatically logged into the agent.
  • Conversely, if there is no match, the Windows user is logged in as an anonymous user.

  Once authenticated by either method, the Windows user becomes permanently linked with the Forcepoint ONE SSE user for all subsequent Windows logins.

• Auto-login, Login prompt: Upon installation, the SmartEdge agent immediately attempts to match the logged-in Windows user's SID with a user in the Forcepoint ONE SSE's IAM database.
  • If there is a match between the Forcepoint ONE SSE user's SID and the Windows user's SID, the Windows user is automatically logged into the agent.
  • Conversely, if there is no match, the SmartEdge agent prompts the Windows user to login and to authenticate before the agent can apply appropriate policy controls.

  Once authenticated by either method, the Windows user becomes permanently linked with the Forcepoint ONE SSE user for all subsequent Windows logins.

• Anonymous only: The agent will always just see the user as anonymous in order to apply appropriate policies. This can be used when controlling access by the specific user doesn't matter (they will just be applied whatever general policy line instead of a unique one per user/group).
• Login prompt only: Upon installation, the SmartEdge agent prompts the Windows user to login. Once authenticated, the Windows user becomes permanently linked with the Forcepoint ONE SSE user for all subsequent Windows logins by the same Windows user. Each new Windows user login follows the same process—the user is prompted and then permanently associated.

Login Groups

When using one of the Auto-login options, you can denote specific groups (such as IT) who will always be prompted with a login window even if an auto-login option is selected. You will see the option appear in the top right corner and you can select/add any number of configured groups to exclude from auto-login.