FireSight docs

Sign-in methods

Administrators choose how people sign in under Settings, Sign-in methods. There are four tabs: General, LDAP / Active Directory, OpenID Connect and SAML. A dot after a tab name means that method is on. Each tab has its own Save button, and every change is written to the audit log.

Directory and single sign-on secrets (the LDAP service account password and the OpenID Connect client secret) are encrypted with FIRESIGHT_SECRET_KEY and never shown again.

General

Setting Default Meaning
Public address of FireSight empty, or FIRESIGHT_PUBLIC_BASE_URL The address people use in their browser, such as https://firesight.corp.example. Single sign-on redirects come back here. Leave empty to use the address of each request. Set it whenever FireSight is behind a reverse proxy.
Allow FireSight accounts (username and password stored here) on When off, only administrators can sign in with a FireSight account, so you can't lock yourself out. Turn on another method first; FireSight refuses to turn this off otherwise.

Groups and roles

LDAP, OpenID Connect and SAML each map groups to FireSight roles in the same way:

  1. Under Groups and roles, click Add group.
  2. Enter the group and pick the Role it grants. Add as many rows as you need; a person gets every role their groups map to. Remove deletes a row.
  3. Optionally choose a Default role for people who match no group. None (refuse) (the default) refuses them. The default role can't be Administrator: the Administrator role is only ever granted by an explicit group mapping.

Group names match case-insensitively. For LDAP, a mapping matches the group's full DN or just its name (CN). Roles are re-read at every sign-in.

LDAP / Active Directory

FireSight binds with a service account, searches for the user, then binds as the user to check the password. Passwords must be encrypted in transit: use ldaps://, or ldap:// with StartTLS.

Setting Default Meaning
Turn on directory sign-in off Shows the directory choice on the sign-in page. Needs at least one server and a user search base.
Button label Company directory The name of the choice on the sign-in page.
Timeout (seconds) 10 Connection and response timeout, 1 to 60.
Servers empty One per line, tried in order, such as ldaps://dc1.corp.example.
Use StartTLS (for ldap:// servers) off Required for ldap:// servers.
Verify the server certificate on Turn off only in a lab.
CA certificate (PEM) empty Only if your directory uses a private CA the FireSight server doesn't trust.
Service account DN empty For example CN=svc-firesight,OU=Service,DC=corp,DC=example.
Service account password empty Stored encrypted. Leave empty to keep the saved one.
User search base empty For example DC=corp,DC=example.
User filter (&(objectClass=user)(sAMAccountName={username})) Must contain {username}, which is replaced with what the person types (escaped).
Username attribute sAMAccountName
Display name attribute displayName
Email attribute mail
Group attribute memberOf
Include nested groups (Active Directory) off Also finds groups the user belongs to through other groups.
Group search base the user search base Shown when nested groups are on.

To test, optionally enter a Username to look up and click Test saved settings. Save first: the test uses the saved settings.

OpenID Connect

Works with Microsoft Entra ID, Okta, Google, Keycloak and other OpenID Connect providers. FireSight uses the authorization code flow with PKCE, and verifies ID tokens against the provider's published keys.

  1. Register FireSight at your provider as a web application with the Redirect URI shown at the top of the tab (it ends in /api/auth/oidc/callback).
  2. Fill in the settings below and click Save.
  3. Click Check the issuer to confirm FireSight can read the provider's configuration.
Setting Default Meaning
Turn on OpenID Connect sign-in off Needs the issuer and client ID.
Button label Single sign-on Shown as Sign in with ….
Issuer URL empty An https:// URL, such as https://login.microsoftonline.com/<tenant>/v2.0.
Client ID empty From your provider.
Client secret empty Stored encrypted. Leave empty to keep the saved one.
Scopes openid profile email Add the scope your provider needs to send groups, if any.
Username claim preferred_username
Groups claim groups Nested claims work, like realm_access.roles.
Name claim name
Email claim email

Note

Entra ID sends group object IDs in the groups claim unless you configure it to send names. Map whatever values it sends.

SAML 2.0

FireSight is the service provider, and sign-in starts from FireSight (SP-initiated). Assertions must be signed; FireSight checks the signature against the identity provider's certificate, and guards against signature wrapping, replay, and wrong audience, recipient or time. Encrypted assertions aren't supported yet.

  1. Give your identity provider the details at the top of the tab, or its Metadata address:
    • Entity ID (by default the metadata address);
    • Assertion consumer service (ACS), ending in /api/auth/saml/acs;
    • Metadata, ending in /api/auth/saml/metadata.
  2. Paste the identity provider's metadata XML into Identity provider metadata and click Read metadata. This fills in the three IdP fields. Or fill them in by hand.
  3. Map groups to roles, tick Turn on SAML sign-in and click Save.
Setting Default Meaning
Turn on SAML sign-in off Needs the IdP sign-in URL and signing certificate.
Button label SAML single sign-on Shown as Sign in with ….
IdP entity ID empty
IdP sign-in URL (HTTP-Redirect) empty An https:// URL.
IdP signing certificate empty PEM. Checked when you save.
Username attribute empty Empty uses the NameID.
Groups attribute groups
Display name attribute displayName
Email attribute email

Break-glass access

FireSight accounts that hold the Administrator role can always sign in with their password, even when FireSight accounts are turned off. Keep at least one such account with a strong password, for when the directory or identity provider is unavailable.

← Users and roles Connections →