To enable your users to successfully authenticate with ForgeRock, you need to make the following manual configurations in the Octopus Management Console (MC):
Add ForgeRock as a third-party authenticator in the MC
Enable ForgeRock authentication for the relevant directory (or directories)
Adding the ForgeRock Authenticator
The Authenticators tab of the System Settings menu allows you to add and manage third-party authenticators. Follow the steps below to add an authenticator that is based on the built-in ForgeRock template.
You can create multiple authenticators using the same template, according to your organizational needs. For example, you might want to have a separate authenticator dedicated to OTP authentication.
To add a ForgeRock authenticator:
Log into the Management Console and navigate to System Settings > Authenticators. Then, click Add Authenticator.
The Add 3rd Party Authenticator dialog opens.
In the Authenticator Name field, enter a friendly descriptive name for the new authenticator.
Open the Template dropdown list and select the template based on ForgeRock (e.g., forgerock_v1).
By default, both of the following Methods are enabled for a new authenticator:
Authenticator: The third party-authenticator can be used as an additional means of authentication (primary and/or secondary).
OTP Validator: The third party-authenticator can be used for one time password authentication (online and/or offline).
If you do NOT want to use the new authenticator for a method, clear the relevant checkbox.
Specify whether to send user credentials to the third-party authenticator by enabling or disabling the Send Credentials toggle button.
When credentials are sent (default setting), the third-party authenticator sends back a token for the User Portal, and the Portal opens automatically upon user authentication to Windows or Mac. If credentials are not sent, no token is sent back, and users will need to manually log into the User Portal after being authenticated by the third party.
Enable / Disable the DMZ Delegation toggle as required. When this setting is enabled, Authentication Servers in the DMZ can communicate directly with a server within the internal network.
Enter the following settings in the appropriate fields:
URL: The access URL for your ForgeRock identity platform
Chain / Tree: Name of the relevant node in the Authentication Tree
Realm Path: Name of the relevant realm in the AM console
Web SSO Tree: URL of the winsso tree in your ForgeRock OpenAM. This tree enables automatic launching of the user’s dashboard upon user login to a Windows or Mac workstation.
Send Headers: When the toggle is enabled (default setting), HTML headers (IP, User-Agent, Primary-Auth-Type) are sent to the ForgeRock directory.
To check the validity of your settings, click Test Connection.
Click Add.
The dialog closes, and the new authenticator is added to the list in the Authenticators tab.
Enabling ForgeRock Authentication for the User Directory
Selection of the primary (and secondary) mobile authenticator and the OTP validator is done at the directory level. You can set the authenticator(s) that provide authentication for users in the Authenticators tab of the directory's settings.
IMPORTANT: In In order to make these selections in the directory settings, the relevant methods (Authenticator and OTP Validator) must be enabled for the third party authenticator in the System Settings menu, as described in the section above.
To enable ForgeRock as an authenticator and/or OTP validator for a directory:
In the Management Console, open the Directories menu.
In the tile or row of the relevant directory, click
to display the directory settings. Then, select the Authenticators tab.
Enable / Disable Octopus Server authentication by clicking the Octopus Authenticator toggle button.
If this setting is disabled, users will not be able to authenticate with Octopus Authenticator, and you need to specify another authenticator. You can also specify an additional authenticator when Octopus Authentication is enabled.
To enable your ForgeRock authenticator, select it from the Additional Authenticator list.
The settings below the list are then enabled.
Configure the following settings as required:
Enable Authenticator as Primary: When enabled, the ForgeRock authenticator will serve as the first line of authentication. If the Octopus Authenticator is enabled, both authenticators will be primary authenticators, and the user will have the option to choose which one to use.
Enable Authenticator as Secondary: When enabled, the ForgeRock authenticator receives user information from the primary authenticator and then approves or rejects authentication.
Authenticator User Mapping: Select a parameter to be used for authentication mapping. The options that appear in the dropdown list are the parameters that are defined in the Personal tab of your users' accounts.
Scroll to the Software OTP Authentication Settings in the Authenticators tab. Here you can enable either or both of the following options:
Online OTP: When enabled, enrolled users are able to log into Windows, Mac or the User Portal using a one time password issued by either the Octopus Authenticator or by a third-party authenticator.
Offline OTP: When enabled, enrolled users are able to log into Windows / Mac using a one time password that is stored locally. These OTPs are supplied by either the Octopus Authenticator or by a third-party authenticator.
When offline OTP is activated, a list of OTPs are securely stored on the Windows / Mac workstation to allow users to authenticate to the workstation when not connected to the network. The OTPs are timed-based and use the standard TOTP mechanism. They can therefore be added to any standard authentication mobile app that supports TOTP.
To activate online OTP, click the Enable Online OTP toggle button. Then, select the appropriate authenticator from the Online Validator list.
Under Validator User Mapping, select the user parameter to be used for OTP authentication.
To activate offline OTP, click the Enable Offline OTP toggle button. Then, select the appropriate authenticator from the Offline Validator list.
From the Shared Secret Mapping, list(s), select the mapping field(s) to be used to generate the offline tokens. The second Shared Secret Mapping field is optional.
If relevant, specify a value (in seconds) for the OTP Time Drift by dragging the slider to the required value. The maximum valid value is 600 seconds.
Under OTP Configuration, specify the appropriate settings. Make sure your settings match the OTP parameters of the authenticator you have chosen to generate the OTP tokens.
At the bottom of the Authenticators tab, click Save. Then, from the toolbar at the top of the page, click PUBLISH and publish your changes.