Technical Tip: FortiSASE support for the SCIM feature

The System for Cross-domain Identity Management (SCIM) is an open-standard protocol that facilitates the exchange of identity data between platforms. This feature is supported in FortiSASE now.

See the documentation for the FortiGate support: SCIM server support.

The FortiSASE enables the following configuration:

config system global

    set scim-http-port 44558 
    set scim-https-port 44559 
    set scim-server-cert "SSL_VPN" 

end

config system interface
    edit "port4"

        set allowaccess ping scim

end

config user scim
    edit "FORTISASE_SAML_SERVER_SCIM"
        set id 1
        set status enable
        set base-url "https://service-examplesase.edge.prod.fortisase.com/fortisase_saml_server_scim/scim/v2"
...
    next
end

config user saml
    edit "FORTISASE"
        set entity-id "https://turbo-examplesase.edge.prod.fortisase.com:7831/XX/YY/ZZ/saml/metadata"
        set single-sign-on-url "https://turbo-examplesase.edge.prod.fortisase.com:7831/XX/YY/ZZ/saml/login"   
        set single-logout-url "https://turbo-examplesase.edge.prod.fortisase.com:7831/XX/YY/ZZ/saml/logout"
        set idp-entity-id "http://**.**.**.**/saml-idp/swg/metadata/"
        set idp-single-sign-on-url "https://**.**.**.**/saml-idp/swg/login/"
        set idp-single-logout-url "https://**.**.**.**/saml-idp/swg/logout/"
        set idp-cert "sase"
        set scim-client ''
    ..

    next

    edit "FORTISASE_SAML_SERVER"
        set cert "SSL_VPN"
        set entity-id "https://turbo-examplesase.edge.prod.fortisase.com/remote/saml/metadata"
        set single-sign-on-url "https://turbo-examplesase.edge.prod.fortisase.com/remote/saml/login"
        set single-logout-url "https://turbo-examplesase.edge.prod.fortisase.com/remote/saml/logout"
        set idp-entity-id "http://test.examplesase.com/saml-idp/agent/metadata/"
        set idp-single-sign-on-url "https://test.examplesase.com.com/saml-idp/agent/login/"
        set idp-single-logout-url "https://test.examplesase.com.com/saml-idp/agent/logout/"
        set idp-cert "sase_new"
        set scim-client "FORTISASE_SAML_SERVER_SCIM"
        set scim-user-attr-type user-name 
        set scim-group-attr-type display-name 
        ..
    next
end

Note: The SCIM is only available for FortiSASE instances enabled with IPsec remote agent support.

It is not supported in instances with hybrid IPsec/SSL enabled.