New Member

Question

SAML Auth for FortiClient EMS user verification using Azure AD as IdP

Forum|Forum|3 years ago
November 15, 2022
11 replies
8680 views

I'm using EMS 7.0.7 and client 7.0.7

I want to use saml auth with azure AD as the IdP when creating an invitation for user verification. I have my AD domains imported. Azure is setup to be the IdP and the test is successful.

If I add the saml configuration in EMS user management with "None" as the authorization type I can get it to work using a bulk invitation. If I add saml configuration with "LDAP" as the authorization type and assign an imported domain I get an error on the client when connecting the EMS in zero trust telemetry.

It looks to me like the imported domains are using the SamAccountName for the users and the SAML configuration is using the UserPricipalName for the assertion attribute. I'm not sure how to setup the domain identification.

FortiNet does have some documentation on this setup but, it doesn't give allot of information

https://docs.fortinet.com/document/forticlient/7.0.7/ems-administration-guide/156283/saml-configuration

Has anybody set this up and how did you make it work?

Anthony_E

Staff

Hello LSI-IT,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

Best Regards

Anthony_E

Staff

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

Best Regards

Anthony_E

Staff

Hello,

I have found this document:

https://docs.fortinet.com/document/fortigate-public-cloud/6.2.0/azure-administration-guide/584456/configuring-saml-sso-login-for-ssl-vpn-with-azure-ad-acting-as-saml-idp

Could you please have a look and tell me if it helped?

Regards,

Best Regards

LSI-ITAuthor

New Member

Thanks Anthony_E, That document is for configuring SAML on a FortiGate with Azure AD as the IdP. I'm trying to use it on FortiClient EMS. I did get an update this morning from Fortinet support that using Azure AD as the IdP in a SAML connection in EMS will be supported in version 7.2.1 It's a little confusing because the documentation already reads like it's supported. It would still be great to know if anyone else has experienced this issue and what they did to work around it.

Zakari81

Explorer

Hi LSI-IT,

I am having the same issue, no documentation on it, i am using EMS version 7.0.7.0398

Anthony_E

Staff

Hello,

Indeed :)!

I will try to find you somebody!

Regards,

Best Regards

GenesisTechhub

New Member

I have the same issue. Has anyone found a resolution for this?

JonasV

Explorer

I have the same issue, trying to connect to EMS from my FortiClient by using SAML invite

ALLEOFLO

New Member

Same Bug here in 7.2.2 :(

xlntech

New Member

Anyone get anywhere with this? FortiDocs are the worst.

BreakinLabs

New Member

The crucial step lies in employing a custom claim within FortiClient, such as the username, and subsequently configuring a corresponding claim with identical nomenclature in the attributes within Azure, which should be mapped to the userprincipalname.

Sign up

Login with SSO

Login to the community

Login with SSO