FortiAuthenticator SAML for FortiSIEM

Ok, now, as promised, here is the step-by-step guide:

On FortiAuthenticator

1. Do the general setup of FAC, which includes defining IP addresses, access ports, etc.
2. Create user(s) that match exactly the users you like to use on FortiSIEM. You can connect these two by using LDAP, but to focus on just SAML connection, we will not talk about that one.
3. Make sure you know the realm the users are in (if not default), you will need that one later
4. Under Authentication -> SAML IdP -> General, define:
   1. The server address (note that this can differ from the FQDN which you have to set in System settings). You may use a port by adding :(portnumber), like iam.my-siem.com:10443 (if you only have limited public IP addresses, you will like to do so)
   2. The IdP-initiated login URL is the one you will need to share with your users, as FortiSIEM cannot (at time of writing) initiate the SAML login on its side. Btw, FortiSIEM is called the "Service Provider" in this setup.
   3. Either check "Use default realm when user-provided realm is different from all configured realms" or tell the users to use the realm along with their name to log on
   4. Configure the realms accordingly; in the simplest case, you may leave everything at it is
   5. Choose the default IdP certificate, which can be just anything. The only thing you need to make sure is that it is not expired (which you might need to consider in a couple of years again!). Feel free to use the built-in one.
   6. You can leave all the other options unchecked
   7. Click Save
5. Switch to "Service Providers" (also under Authentication -> SAML IdP)
   1. Create a new entry
   2. Set a name you like to use; that one is only used in the list of apps for the user then
   3. Add a custom IdP prefix (choose whatever you like, will be part of the internal redirection URLs)
   4. You will need the IdP entity id later, copy that url
   5. Use the default configured certificate and signing algorithm (as this is configured in "General" for all logons then)
   6. Enable "Support IdP-initiated assertion response", as this is the only way you can log on to FortiSIEM. You don't have to configure any Relay state, but you may want to pick a good icon for your system; especially if you need to configure multiple logons sometime in future
   7. Save this entry, because some options will become visible only after saving
   8. Edit the entry again
   9. You now have "SP Metadata". This is the most critical part.
      1. For SP entity ID, you will like to choose the organization, which is "Super" (case-sensitive!)
      2. For SP ACS (login) URL, you set https://(yourdomain)/phoenix/sso/saml/(name of external authentication profile in the FortiSIEM)
   10. Make sure, Assertion Attribute Configuration -> Subject NameID is set to Username
   11. I've also set the following Asserting Attributes:
       1. Attribute "username" maps to Username
       2. Attribute "organization" maps to Realm. Note that this does not work on the "Super" organization as a realm will always be lowercase ("super") but the FortiSIEM expects an uppercase "S". But what you can do with this, is mapping every tenant by letting the users sign in with their correct realm on the IdP and only have one "customer" and one "supervisor" link on the page (addressing sioannou's issue mentioned above)
   12. Save
   13. Then go back to the very same editing page and press the "IdP metadata"-download-button next to the save button. You will need some of these information later

Now, you can switch to FortiSIEM

On FortiSIEM

1. Go to Admin -> Settings -> General -> External Authentication and create a new one
   1. Create a name which matches exactly the one you configured on the FortiAuthenticator under "SP ACS (login) URL", the last part after the last forward slash
   2. You will probably want to use this system-wide, so choose "System" as Organization
   3. Protocol is obviously "SAML"
   4. For "Issuer", insert the URL you copied from "IdP entity id" above. You find it also in the downloaded "idpssodescriptor.xml" as entityID parameter
   5. The certificate is in the very same file. Copy the content between the "ds:X509Certificate" tags and paste it here.
   6. As user, I used the custom Attribute "username", but it will also work with the default setup
   7. As Organization, if you have the "Super" organization, you must use the default (Audience element) and make sure you have entered "Super" in the "SP entity ID" on FortiAuthenticator. Otherwise, you may use the realms of FortiAuthenticator which are in this setup present in the custom attribute "organization"
   8. Leave the Role on None. If you like to use roles, you also need to set this up as a custom attribute on the FortiAuthenticator (I'd recommend user groups here, if you only have one per user) and use the very same names on the FortiSIEM under Admin -> Settings -> Role -> SAML Role. As far as I understand, this also enables creating new users in the CMDB just by them authenticating via IdP
   9. Save
2. Suppose you want you existing user being authenticated this way, go to the CMDB, edit the according user and click on the edit Button next to "System Admin"
1. Choose Mode: External
2. Select your SAML-Authentication profile
3. Select a default role for all or the desired organizations
4. Note, that the user must be in the correct organization provided by the SAML-IdP-exchange (like "Super", as mentioned multiple times now)
3. The defined user(s) can now log on via the url we had right at the beginning, which reads something like https://iam.my-siem.com/saml-idp/portal/

I hope this helps everyone how is facing the same question like I did.

Best,

Christian

FortiAuthenticator: General

FortiAuthenticator: Service Provider

FortiSIEM