Technical Tip: How to configure OAuth 2.0 for Server Policy Frontend Authorization with Integration of FortiAuthenticator as the OAuth Server

Prerequisite:

• FortiWeb is configured to work as an OAuth 'Open Authorization' client.
• The FortiAuthenticator interface is enabled with the OAuth services.

Create an OAuth Resource Server service in FortiAuthenticator:

1. Create the OAuth Portal in the OAuth Service:

2. Create the OAuth policy and select the OAuth Portal that is being created in the previous step.

3. In the OAuth policy identity sources setting, select the specific realm if necessary. Enable the group filter to allow specific group users to authenticate with the OAuth policy.

4. Save and exit the OAuth Policy settings:

5. Create the Relying Party and select the OAuth Policy created in the previous step. Adjust the Token expiry based on the requirements. In the Client type option, select Confidential and select Authorization code for Authorization grant types. Copy and store the client ID and client secret in a file, as the client secret value will be displayed only once. Insert the URLs that will be redirected to by the OAuth configured in FortiWeb and the logoff path of the website to log out of OAuth. Add at least one relying party scope to the relying party.

Configure the OAuth Site Publishing policy in FortiWeb:

1. After completing the configurations in FortiAuthenticator, move on to FortiWeb. Create the OAuth Request by cloning all five FortiAuthenticator OAuth request templates.

2. Edit each of the cloned OAuth requests and replace the endpoint URL IP/Domain settings with the FortiAuthenticator IP or FQDN hostname.

3. Make sure all the OAuth Request has the correct endpoint URL.

4. Navigate to the OAuth Server tab and create a new OAuth Server. In this example, FortiWeb is acting in the OAuth Client mode. Insert the Client ID and Client Secret using the value copied from the FortiAuthenticator OAuth Relying Party. The Redirection Endpoint must be the same as the URL value configured in the FortiAuthenticator Authorized Success Callback URLs. For the list of requests on the page, select the OAuth Request that was cloned and edited in the previous steps.

5. Navigate to the OAuth Server Pool page under the Site Publish category. Create a new OAuth Server Pool with the same mode as the Client. Create the Authentication server in the OAuth Server Pool. Take note of the OAuth Server Name, as the value will be utilized in the FortiWeb Replacement Message later. Select the OAuth Server that is being created in the previous step.

6. Go to the Site Publish page and create a site publish rule. In the site publish rule, insert the name, published site, and path. Select the OAuth Authentication as the client authentication method and select the OAuth server pool with the pool created in the previous step.

7. Create the Site Publish Policy and add the Site Publish Rule to the policy.

8. The OAuth login page must be configured to match the OAuth Server name configured in [Step 5]. Clone the predefined Replacement Message policy to a new policy to customize the page.

9. Edit the OAuth Login Page in the Replacement Message policy.

10. The predefined OAuth login page comes with other OAuth Server provider types.

11. Remove the lines of the unwanted provider server type. Update the value of the FortiAuthenticator server using the OAuth Server name configured in Step 5.

12. The OAuth Site Publish Policy and the Replacement Message are configured. Navigate to the Server Policy to edit the relevant server policy and configure the Replacement Message policy.

13. Edit the Web Protection Profile of the Server Policy to enable the Site Publish Policy rule.

14. Test browsing the website pointing to the server policy. The host matching the published site shall trigger the Site Publish OAuth policy, and users will be returned with the OAuth login page.

15. Select FortiAuthenticator and continue; users will be redirected to the OAuth login page. Insert the valid username and password to log in.

16. Users will be prompted with the Authorize page after successful login. Select Authorize to continue.

17. The page is now showing the actual contents from the backend real server after passing the OAuth login.

18. Both FortiAuthenticator and FortiWeb shall be able to track the OAuth login activity if logging is enabled.

FortiAuthenticator:

FortiWeb:

Related documents:

OAuth authorization & OIDC authentication