External Browser-based Authentication - Netskope Technical Documentation

The Netskope Client supports FIDO authentication on Windows and macOS devices using external browser integration with the SAML forward proxy. When you enable external browser support during the Netskope Client deployment, the authentication flow transitions from the Client’s built‑in browser to the operating system’s default browser. This adjustment enables the use of more advanced and robust web authentication mechanisms.

This feature is supported for Internet Security and Private Access (NPA).

Windows

In Windows, external browser support is available for MS Edge, Google Chrome, and Firefox when set as the default browser.

When deploying the Netskope Client in IDP mode (for single or multi-user environments), you can enable this functionality by modifying the MSIEXEC command line with additional parameters.

idpmode=scheme
httpmethod=get|post (Optional)

The following parameters are mandatory if you include idpmode=scheme in the command line during installation. The installation will not be successful without them.
– installmode
– tenant
– domain

For example, while deploying Netskope Client on Windows using Intune, you can configure these parameters in the Command-line arguments field as follows:

msiexec /I STAgent.msi installmode=idp|idpOnly tenant=nsclient domain=goskope.com [enrollauthtoken=<Authentication Token>] [enrollencryptiontoken=<Encryption Token>] idpmode=scheme [httpmethod=post]

To learn more, view External Browser Support in Intune.

macOS

In macOS, external browser support is available for Safari, MS Edge, and Google Chrome when set as the default browser (Firefox is not supported).

While deploying Client in IDP mode (for single-user or multi-user environments), you can enable this functionality by configuring the additional parameters in the MDM. The following parameters are appended in the MDM policy, for example, Jamf Policy:

Mode: Mode is a string value used to enable external browser support
- Embedded: Default value and opens the existing mini-browser.
- Scheme: Opens the external browser (system default browser).
preferEphemeral:
- True: An ephemeral (private) browser window will be launched from the default browser.
- False: A regular (non-private) browser window will be launched from the default browser.
httpmethod: httpmethod alters the web authentication flow in efforts to alleviate issues with the Safari browser and redundant WebAuth.html notification pop-ups. If Safari is not the default browser, this parameter (httpmethod) is not needed.
```
httpmethod=get
```

For example, if you are using Jamf Pro to deploy Netskope Client on your macOS devices, you can use these parameters in the Jamf script available in Netskope Support portal. To learn more, view External Browser Support in Jamf Pro.

sudo ./nsclientconfig.sh 1 2 3 idp goskope.com corp 0 mode=scheme preferephemeral=true httpmethod=get