In this scenario, user access to the internet is allowed only after successful SAML authentication to AWS IAM Identity Center. FortiGate acts as a SAML Service Provider (SP), and the IAM identity center is the SAML Identity Provider (IDP) where the user database is located.
Operation flow:
The user attempts to access any web page from the browser. FortiGate redirects the browser to the local captive portal for a short instant and then redirects again to the SAML IDP access portal. The user authenticates to the IAM identity center portal by username/password, and if enabled, will also be prompted to enter an MFA 6-digit code. IAM identity center IDP sends SAML assertions containing user information to the user's browser. The browser relays this information to FortiGate, which allows or denies access based on configured Firewall policies.
Configuration:
Create a SAML application in AWS IAM Identity Center.
Go to IAM Identity Center -> Applications -> Add application.
Configure SAML IDP and SAML SP settings.
Download the following from the IAM Identity Center:
SAML IDP metadata file. IDP certificate.
Import the IDP certificate and configure SAML settings in FortiGate.
Go to System -> Certificates -> Create/Import -> Remote Certificate. Select the IDP certificate downloaded earlier.
Go to User & Authentication -> Single Sign-On and select 'Create New'. Configure SAML SP and SAML IDP settings.
Use the following attributes to identify users and groups:
Attribute used to identify users = username. Attribute used to identify groups = group. Select 'OK' to complete the SAML configuration in FortiGate.
Configure attribute mappings in the IAM Identity Center.
Go to the IAM Identity Center -> Applications -> Customer managed.
Select the application and then in the 'Actions' tab select 'Edit Attribute mappings'. Apply the attributes for the username.
Configure a user group and Firewall policies in FortiGate.
CLI configuration to create a user group:
config user group
 edit "AWS_IAMgroup"
  set member "AWS_IDP_SAML"
 next
end
Create a firewall policy that allows the user to access the AWS access portal. Use the internet service 'Amazon-AWS' as a destination.
Configure a second firewall policy for user authentication.
Validation:
When the user attempts to access any page on the web, the user will be prompted to log in. FortiGate will initially redirect to the local captive portal and then to the AWS access portal.
If enabled in IAM Identity Center, the user will also be prompted for an MFA token. After successful authentication, it is possible to configure in FortiGate the successful authentication events and firewall user entry.
Go to Log & Report -> System Events -> User Events.
Go to Dashboard -> Assets & Identities -> Firewall users:
Related documents:
| 
