Adding an identity provider using OpenID Connect

This procedure explains how to integrate Forescout Cloud with an IdP using the OpenID Connect protocol.

The following prerequisites must be set in your IdP configuration (consult your IdP vendor's documentation):

  • Scopes: Add the necessary OpenID, email and profile scopes.
  • Attribute Mapping: Check and ensure that the "email" attribute is mapped to "email address" in your application configuration.
  • Claims: Check and ensure that the "email" claim is added and exposed in your application configuration.
  • You must register Forescout Cloud with your IdP as an application, making Forescout Cloud the app domain. Use the following URL as the value for the URL/Callback URL field of your application configuration, depending on which cloud service your tenant is hosted by: https://login.oas.command.cysiv.com/oauth2/v1/authorize/callback

You will need the following authentication and reference information on hand:

  • CLIENT ID

  • CLIENT SECRET

  • ISSUER

  • AUTHORIZATION ENDPOINT

  • TOKEN ENDPOINT

  • JWKS ENDPOINT

To add OpenID ConnectID to Forescout Cloud, complete the following procedure:

  1. Select the Identity Provider tab under Administration > Account Settings.
  2. Click + Add Identity Provider.
  3. Select OpenID Connect from the Identity Provider dropdown.
  4. Enter your choice for the name of this IdP integration in the NAME field.
  5. Enter the email domain for your OpenID Connect account in the EMAIL DOMAIN field.
  6. Enter the following authentication information in the following fields under the AUTHENTICATION TYPE section of the configuration form:
    • CLIENT ID

    • CLIENT SECRET

    • ISSUER

    • AUTHORIZATION ENDPOINT

    • TOKEN ENDPOINT

    • JWKS ENDPOINT

  7. Click the Save button.
    The configured IdP will appear on the main Identity Provider view.
  8. The connection must be successful to enable the IdP configuration. Test it as follows:
    1. Copy the test URL.
    2. Open a new incognito tab and paste in the URL.
    3. Check the results of the test posted on the main Identity Provider view.

When the test confirms that the IdP has been successfully configured, it will appear in the list of configured IdPs with a TEST STATUS of SUCCESSFUL. You can then enable the IdP by clicking the Enabled check box.