Fortigate client based ssl-vpn with saml group matching

Forum|Forum|2 years ago
April 25, 2024
2 replies
2929 views

I am testing out client based ssl-vpn using SAML Auth. When I debug saml on the fortigate I see that group that comes back from SAML is correct but I am getting added to the wrong portal.

I have users group configured as per https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-administration-guide/584456/configuring-saml-sso-login-for-ssl-vpn-with-entra-id-acting-as-saml-idp with:

config user group

edit FortiGateAccess

set member azure

config match

edit 1

set server-name azure

set group-name <object ID>

How does the fortigate relate the group name to the portal name?

FortiGate

Best answer by dbu

Multi-realm can serve also in the scenario where user is part of several groups and you want to make sure it will access the right portal based on that group membership/

I think you need to verify the authentication rules and check if the group is mapped to a portal.

I believe you are not matching a group on the list and going to the default portal at the end.

systemgeekAuthor

Visitor III

In ssl-vpn settings I see at the bottom Authentication/Portal Mapping. So does that mean the group name from saml must match the portal name?

dbu

Staff

Hi @systemgeek ,

I believe you need to create authentication rules with multi-realm :

SSL VPN multi-realm | FortiGate / FortiOS 7.4.3 | Fortinet Document Library

SSL VPN authentication | FortiGate / FortiOS 7.2.8 | Fortinet Document Library

systemgeekAuthor

Visitor III

It looks like the ssl-vpn multi-realms is for setting individual login pages for different realms.

I want to know what connects the group attribute that SAML returns to the vpn portal. I am pretty sure I deleted something or broke something and thats why its not working right. Authentication Settings might be it but I am clueless on how to configure it right.

dbuAnswer

Staff

Multi-realm can serve also in the scenario where user is part of several groups and you want to make sure it will access the right portal based on that group membership/

I think you need to verify the authentication rules and check if the group is mapped to a portal.

I believe you are not matching a group on the list and going to the default portal at the end.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded