Skip to main content
Nara
Nara
New Member
February 14, 2025
Question

FortiProxy FSSO Implementation Challenge - User Object Definition

  • February 14, 2025
  • 1 reply
  • 1827 views

Hi All,

 

I am writing to inquire about a challenge I've encountered while implementing Fortinet Single Sign-On (FSSO) on my FortiProxy in a lab environment.

Current Setup

  • I have successfully integrated the FSSO Collector Agent in DC Agent mode with my Active Directory (AD) and Domain Controller (DC) servers.
  • However, when attempting to define a user object of FSSO type under the User Definition submenu, only AD Groups are generated. I am unable to select specific AD Users.

Questions

  1. Does the FSSO configuration on FortiProxy differ from that on FortiGate? On FortiGate, I can define FSSO users by selecting specific AD Users under User Definition. This does not appear to be the case with FortiProxy.
  2. If defining FSSO users by specific AD User is not possible on FortiProxy, how can I implement FSSO in FortiProxy policies? I have several proxy policies that require source addresses to be defined by specific AD Users.

 

I would appreciate any insights or guidance you can provide to resolve this issue.

Thank you for your time and assistance.

Sincerely,

Nara

1 reply

rbraha
Staff
rbraha
Staff
February 14, 2025

Hi @Nara 

 

You can specify user group info where this user is part in AD ,no need to import specific user as FSSO , check the guide below it might help.

 

https://docs.fortinet.com/document/fortiproxy/7.6.0/fortiproxy-authentication-guide/9081/using-single-sign-on-with-the-fsso-agent

    Nara
    NaraAuthor
    New Member
    February 15, 2025

    Hi @rbraha ,

     

    Thank you for your answer!

    I need to create a user-specific policy. If I implement your suggestion, where the source object in the proxy policy is based on a user group in Active Directory, the proxy policy I create will affect all users in that group, whereas I only want it to affect one user. Is it possible for the source object to be a specific user with FSSO user type? Because when I check the User Definition configuration on Fortigate, we can define users specifically with the FSSO user type.

     

    Sincerely,

    Nara

    Terms & ConditionsAccessibility statement