Forcepoint Security Manager (FSM) SAML Integration

This document explains how to implement Monosign with Forcepoint Security Manager (FSM). It covers Single Sign-On using SAML 2.0, where Monosign acts as the Identity Provider (IdP) and Forcepoint Security Manager as the Service Provider (SP). Before you continue, it is better to start with the Forcepoint Security Manager documentation about the SAML 2.0 single sign-on.

This configuration is done with Forcepoint Security Manager 10.2. The SAML 2.0 single sign-on feature of FSM is documented and certified by Forcepoint for the Okta identity provider; the settings in this document are the same SAML 2.0 settings with Monosign as the identity provider. If your FSM version is different, please check the Forcepoint documentation.

Monofor has no responsibility to do Forcepoint Security Manager configurations. If you need support please contact Forcepoint or your Forcepoint support provider.

📑 Instructions

This documentation contains 5 main steps for integration.

Creating an application on Monosign
Configuring the SAML settings on Monosign
Assign a user to the Forcepoint Security Manager application
Configuration Single Sign-On for Forcepoint Security Manager
Sign In Test

1- Creating an Application on Monosign

Create your application on Monosign first. Open the Applications page from the left menu and click Add New.

Applications page in Monosign (1: Applications menu, 2: Add New)

Forcepoint Security Manager is not in the application catalog, so click Create from scratch.

Creating a new application from scratch (1: Create from scratch)

Fill in the application details on the Application tab and click Next.

New Application - Application tab (1: Name, 2: Next)

Property	Value	Description
Name	`Forcepoint Security Manager`	Name of the application shown to users on the Monosign portal and on the Monosign sign-in page.
Type	`Web`	Forcepoint Security Manager is accessed through a web browser. Options: Web, Mobile, Desktop, API.
Url	Optional	Leave empty or enter the address of Forcepoint Security Manager (for example `https://<fsm-address>:<port>/manager`).
Logo	Optional	Browse and upload a logo; it is also shown on the Monosign sign-in page.
Users can see this application on their list	`Enabled`	Displays the application on the user portal.

On the Access tab define who can reach the application and click Create Application.

New Application - Access tab (1: Profile Access Type, 2: Create Application)

Property	Value	Description
User Access Type	`System Default`	Defines which users can access this application. Options: Only Assigned Users, All Users, System Default.
User Group Access Type	`System Default`	Defines the application’s user group access.
Source Using Type	`System Default`	Defines which user sources the application can use.
Profile Access Type	`All`	Defines which user profile attributes are available to the application (Options: Restricted, All). Forcepoint Security Manager needs the e-mail address of the user, so the profile must be accessible.

After the application is created, click Keys and add a new Access Key for SAML access.

Keys tab of the application (1: Keys, 2: Add New Access Key)

Select SAML as the key type and click Create. Monosign generates the Key value of the SAML application automatically; it is a part of the Monosign SAML addresses.

Creating the SAML Access Key (Type: SAML)

Property	Value	Options
Type	`SAML`	Rest API, OIDC/OpenID, SAML, RADIUS, Access Gateway, LDAP, AuthN/Z Server
Key	Generated automatically	Unique identifier of the SAML application in the Monosign addresses.
Session	`System Default`	System Default, On-demand, Permanent
State	`Enabled`	Enabled, Disabled
Never Expires	`Yes`	Turn off to define a specific expiration date for the key.

The key page shows the Monosign values that are needed in the Forcepoint Security Manager configuration (step 4):

Monosign value	Example	Used in Forcepoint as
Sign On Service	`https://<monosign-host>/saml/<key>/login`	Identity provider Single Sign-On URL
Entity Id	`https://<monosign-host>/saml/<key>`	Identity provider Issuer
View Certificate / Download Certificate	X.509 certificate of Monosign	X.509 Certificate
Metadata, Download IdP Metadata	`https://<monosign-host>/saml/<key>/metadata`	Not required by Forcepoint; the three values above are entered by hand.

2- Configuring the SAML Settings on Monosign

Open the Edit screen of the SAML key and go to the SAML Settings → Configuration tab. Enter the address where Forcepoint Security Manager receives the SAML response in Assertion Consumer Url and set the Name Id to the e-mail address of the user.

SAML Settings - Configuration tab (1: Assertion Consumer Url, 2: Name Id)

Property	Value	Description
Assertion Consumer Url	`https://<fsm-address>:<port>/manager/rest/v1/sso/samlResponse`	The address where FSM receives the SAML response. Copy it from the Assertion Consumer Service (ACS) URL field of the Single Sign-On page of FSM (step 4).
ACS Validation Mode	`Warn Only`	Default. With `Enforce` Monosign accepts only the registered ACS address.
Audience / Entity Id / Idp Description	Empty	Not required for Forcepoint Security Manager.
NameId Format	`System Default (unspecified)`	Default value.
Name Id	`Email`	FSM identifies the user by e-mail address, so the NameID of the SAML response must be the e-mail address.

Open the Attribute Mapping tab, add the e-mail attribute and click Update to save.

Attribute	Value	Description
email	`{{Email}}`	E-mail address of the user. Forcepoint documents an Email attribute statement with the value of the user e-mail address for Okta; the same value is sent from Monosign.

3- Assign a User to the Forcepoint Security Manager Application

Please follow the below instructions on how to assign a user to the application. Open the application, click the Assignments tab and click Assign a User.

Assignments tab of the application (1: Assignments, 2: Assign a User)

Search and select the users who can sign in to Forcepoint Security Manager, check the Expiration Date and save. You can select more than one user.

Property	Value	Description
User(s)	Selected users	Users who can sign in to Forcepoint Security Manager with Monosign.
Expiration Date	Default one year	The assignment expires on this date.

4- Configuration Single Sign-On for Forcepoint Security Manager

As we mentioned at the start, please check out the Forcepoint documentation first. The SAML settings are made in the web interface of Forcepoint Security Manager by a Global Security Administrator. Open Global Settings → General → Single Sign-On and check Enable Single Sign-on with SAML 2.0 protocol.

Forcepoint Security Manager - Single Sign-On (Enable Single Sign-on with SAML 2.0 protocol)

The section 1. Service Provider details shows the addresses of Forcepoint Security Manager. Use the Assertion Consumer Service (ACS) URL as the Assertion Consumer Url of Monosign (step 2). In the section 2. Identity Provider Configuration enter the Monosign values from step 1.

Forcepoint Security Manager - Identity Provider Configuration (Single Sign-On URL, Issuer, X.509 Certificate)

Property	Value	Description
Enable Single Sign-on with SAML 2.0 protocol	`Checked`	Turns on the SAML 2.0 single sign-on.
Assertion Consumer Service (ACS) URL	`https://<fsm-address>:<port>/manager/rest/v1/sso/samlResponse`	Shown by FSM. Enter it in Assertion Consumer Url of Monosign (step 2).
Audience Restriction URL	`https://<fsm-address>:<port>/manager`	Shown by FSM. It is the Audience (SP Entity ID) of Forcepoint Security Manager; Monosign does not need it.
Identity provider Single Sign-On URL	`https://<monosign-host>/saml/<key>/login`	Sign On Service of the Monosign SAML key.
Identity provider Issuer	`https://<monosign-host>/saml/<key>`	Entity Id of the Monosign SAML key.
X.509 Certificate	`MIIDpTCC…`	The Monosign certificate (View Certificate or Download Certificate on the key page).

Add the users to the Administrators page of Forcepoint Security Manager with the e-mail address that Monosign sends as the NameID. To sign in with SAML, a user must be assigned to the application in Monosign (step 3) and must exist as an administrator in FSM with the same e-mail address.

Do not close your own session before the sign-in test is successful. If the single sign-on fails, a Global Security Administrator can still log in with the Forcepoint Security Manager password; the login page has the link Log in as Global Security Administrator.

Now try to log in to Forcepoint Security Manager using Monosign SSO.

Forcepoint Security Manager login page with the Sign in with Single Sign-On button

Open a new browser window (or a private window) and type the address of Forcepoint Security Manager, for example https://<fsm-address>:<port>/manager.
Click Sign in with Single Sign-On on the login page. The link Log in as Global Security Administrator stays on the page for the fallback login.
FSM redirects the browser to the Monosign sign-in page of the application. You can log in passwordless with your QR code (Monofor Identity), with a Passkey or with your user name and password (Sign in with Password). If you are already signed in to Monosign, the page is skipped.
After the sign-in Monosign sends the SAML response to the ACS URL of FSM and the user is logged in to Forcepoint Security Manager.

Troubleshooting

Symptom	Cause	Solution
The Sign in with Single Sign-On button is not shown	The single sign-on is not enabled in FSM.	Check Enable Single Sign-on with SAML 2.0 protocol and save (step 4).
Monosign shows an error about the ACS address	The Assertion Consumer Url of Monosign is different from the ACS URL of FSM, which matters most when ACS Validation Mode is `Enforce`.	Copy the ACS URL from the Single Sign-On page of FSM exactly as shown (step 2).
The sign-in succeeds on Monosign but FSM does not log the user in	The user does not exist in the Administrators page of FSM, or the e-mail address is different from the Name Id sent by Monosign, or the certificate or issuer is wrong.	Add the user to Administrators with the same e-mail address, check that Name Id is `Email` (step 2) and copy the issuer and the certificate again from the Monosign key page (step 1).
A user cannot sign in	The user is not assigned to the application.	Assign the user in step 3.
The single sign-on does not work and you cannot enter FSM	A wrong value was saved in the SAML settings.	Click Log in as Global Security Administrator and log in with the FSM password, then correct the settings.

After completing the configuration on Forcepoint Security Manager and Monosign, it is better to test in a new private browser window if the SAML SSO doesn’t work, because old session cookies may cause errors.