> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/single-sign-on-sso/forgerock-sso.md).
# ForgeRock SSO
You can configure ForgeRock as your single sign-on SAML provider for logging into DoControl.
{% hint style="success" %}
After you configure ForgeRock as your generic SAML, you can use your ForgeRock credentials to login via DoControl. Note that DoControl supports only service provider initiated SSO via DoControl's login page.
{% endhint %}
To integrate DoControl with ForgeRock SSO, you need to:
1. [Create ForgeRock connection](#create-forgerock-connection)
* [Add hosted entity provider](#add-hosted-entity-provider)
* [Add remote entity provider](#add-remote-entity-provider)
* [Add attribute mapping](#add-attribute-mapping)
* [Add service](#add-service)
* [Add identities](#add-identities)
2. [Add a generic SAML connection](#add-generic-saml-connection)
## Create ForgeRock connection
1. Login to your ForgeRock account, using admin permissions.
2. Go to **Realms** and click **+New Realm.**
3. Name the Realm “DoControl” and click **Create**.
4. In the Realm Overview page, click **SAML Applications**.
5. In the Entity Providers page, go to the side bar and click **Applications > Federation > Circle of Trust**.
6. Click **+Add Circle of Trust**. Name it "DoControl" and click **Create**.
7. In the Circle of Trust DoControl page, make sure the **Status** is Active. Click **Save Changes**.
### Add hosted entity provider
1. In the side bar, go to **Applications > Federation > Entity Providers**.
2. Select **Add Entity Provider > Hosted**.
3. In the New Hosted Entity Provider page, enter these attribute values:
* For **Entity ID**, enter docontrol.
* For **Entity Provider Base URL**, make sure to include your ForgeRock domain in this structure: `https://{{ForgeRock-DOMAIN}}/openam`
* For **Identity Provider Meta Alias**, enter docontrol.
* For **Service Provider Meta Alias**, keep empty.
* For **Circles of Trust**, enter DoControl.
* Click **Create.**
{% hint style="info" %}
* The `{{ForgeRock-DOMAIN}}`can be found in the ForgeRock URL domain, after the ‘https\://’ and before the first ‘/’
* For example, in `https://idp.docontrol.io/openam/ui-admin,`the {{ForgeRock-DOMAIN}} is `idp.docontrol.io`.
{% endhint %}
4. Go to **Assertion Content > NameID Format**.
5. Add the following key and value to the NameID value map:
* **key**: `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`
* **value**: mail
6. Keep the binary toggle off. Click **Add**, then **Save Changes**.
7. Go to the **Assertion processing tab > Local Configuration**
8. For **External Application Logout URL**, enter
9. Click **Save Changes**.
10. Go to the **Advanced tab > SAE Configuration**.
11. Make sure the **IDP URL** follows this structure:\
`https://{{ForgeRock-DOMAIN}}/openam/idpsaehandler/metaAlias/DoControl/docontrol`
12. Go to Relay State URL List.
13. For the **Relay State URL List,** enter `https://app.docontrol.io/`
14. Click **Add** and **Save Changes.**
### Add remote entity provider
1. On the side bar select **Applications > Federation > Entity Providers**.
2. Select **Add Entity Provider > Remote**.
3. Use this [link](https://app.docontrol.io/saml/download.html) to download the XML file for the next step
4. In the New Remote Entity Provider page, drag the XML file or click to browse and upload the XML file.
5. For `Circles of Trust`, enter DoControl.
6. Click **Create**.
7. In the Entity Providers page, click `urn:amazon:cognito:sp:us-east-1_Tx9u9xQ4d`
8. Open the **Assertion Content** tab.
9. Under NameID Format, keep the **Disable NameID persistence** toggle **off**.
10. Open the **Services** tab > **SP Service Attributes**.
11. Add the following values to the **Single Logout Service**:
* For **Predefined Binding,** select: HTTP-REDIRECT.
* For **Location**, enter: ;
12. Click **Add** and **Save Changes.**
### Add attribute mapping
1. Open the Assertion Processing tab.
2. In the Attribute Mapper section, enter these attribute values:
**Attribute number 1**
* Name format Uri: Leave empty
* SAML attribute: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`
* Local attribute: givenName
* Binary: keep toggle off
* Click **Add**
**Attribute number 2**
* Name format Uri: Leave empty
* SAML attribute: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`
* Local attribute: sn
* Binary: keep toggle off
* Click **Add**
**Attribute number 3**
* Name format Uri: Leave empty
* SAML attribute: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`
* Local attribute: mail
* Binary: keep toggle off
* Click **Add**
3. Under Artifact Message Encoding, make sure the Artifact Message Encoding is set to `URI`.
4. Click **Save Changes**.
### Add service
1. On the side bar select **Services > Add service**.
2. Under **service type**, select Validation Service.\
3. For the **Valid goto URL Resources** value, enter:\
`http://{{ForgeRock-DOMAIN}}/openam/saml2/continue/metaAlias/docontrol/docontrol?secondVisitUrl=/openam/SSORedirect/metaAlias/docontrol/docontrol?*`
4. Click **Save Changes**.
### Add identities
1. On the side bar, go to **Identities.**
2. Assign the relevant people or groups to connect DoControl with your identity provider.
3. Make sure that all listed people and groups exist in DoControl as team members.
{% hint style="warning" %}
User names are case-sensitive.
{% endhint %}
## Add generic SAML connection
SAML (Security Assertion Markup Language) 2.0 is an open standard that allows DoControl to connect to your organization's IdP, such as ForgeRock.
SAML makes single sign-on (SSO) possible by authenticating a user once and then communicating that authentication to DoControl.
{% hint style="success" %}
To enable users to login to DoControl with their ForgeRock credentials, follow the instructions to configure a [generic SAML](/docontrol-user-guide/system-management/settings/single-sign-on-sso/generic-saml.md).
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/single-sign-on-sso/forgerock-sso.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
