Overview

Forward Proxy Authentication (FPA) ensures secure access to cloud applications by requiring SAML-based authentication via an intermediary server that allows organizations to enforce granular authentication policies. Netskope’s FPA allows integration of multiple Identity Providers (IdPs) based on criteria like access methods (IPsec, GRE, Cloud Explicit Proxy, NS Client Enrollment) and network location, enabling flexible and secure user authentication management. Organizations can maintain existing SAML setups while utilizing Netskope’s enhanced authentication features, supporting multiple concurrent IdPs to match specific conditions for robust security and control.

Configuration in PingOne

1. Login to the PingOne Admin Console.

2. Navigate to Applications > Application Catalog.

3. Search the Application Catalog for Netskope Client Enrollment and click + Add Instance.

4. Enter temporary values into the ACS URL and Entity ID fields, like https://pingone.com and https://pingone.com/abcde.

5. 

   Select Next.

6. Leave the attribute mapping as the default. 

7. 

   Select the appropriate group(s) for access.

8. Click Save.

9. n the PingOne console, go to Applications > Netskope Client Enrollment > Configuration

10. On the Configuration tab, copy the Single Signon Service URL and store in a text editor.

11. From the Configuration tab, copy the Issuer ID URL and store in a text editor.

12. Download the signing certificate X509 PEM (.crt).

Configuration in Netskope

1. In the Netskope Administrator console under Settings > Security Cloud Platform > Forward Proxy > SAML and click New Account.

2. Enter a name.

3. Select the Access Method, like Client Enrollment or All..

4. Paste the Single SignOn Service URL copied from PingOne into IDP SSO URL

5. Paste the Issuer ID URL copied from PingOne into IDP Entity ID
6. Upload the signing certificate to IDP Certificate.

7. 

   Under Status, Enable this account.

8. Click Save.

9. Click on the Netskope Settings button next to the account you just created, and then copy the SAML Proxy ACS URL and SAML Entity ID fields.

10. In the PingOne console, navigate to Applications > Netskope Client Enrollment > Configuration.

11. Click the edit button.

12. Replace the ACS URL with the SAML Proxy ACS URL copied from Netskope.

13. Replace the Entity ID with the SAML Entity ID copied from Netskope. 

14. Ensure the Netskope Client Enrollment App is enabled in PingOne

Validate SAML Connection

1. Navigate to Settings > Security Cloud Platform > Forward Proxy > SAML
2. Click the Configuration button next to the Certificate Expire Date.
3. Select Test. 
4. Login with an account that is assigned to your Netskope Client Enrollment App
5. Test should be successful