SAML config for VPN SSL

Hi,

you need to configure several things but before you need to identify who will be IdP and who will be SP

In scenario that you are using Azure AD as IdP you need to add under Enterprise application FortiGate SSL VPN solution and add users which need to have access to VPN. Also you can create separate Azure AD group for fine granular separating but in that case you need to add them via CLI on FortiGate.

You need to configure on FG side group and saml user. Saml user is this what you created, it is like object which is pulling data from IdP (Identity Provider).

 1) Setup SAML

config user saml edit azure set entity-id "https://<PublicIP_or_FQDN>:<portIfItIsNot:443>/remote/saml/metadata" set single-sign-on-url "https://<PublicIP_or_FQDN>:<portIfItIsNot:443>/remote/saml/login" set single-logout-url "https://<PublicIP_or_FQDN>:<portIfItIsNot:443>/remote/saml/logout" set idp-single-sign-on-url "<need to get from IdP side, like Azure AD or so>" set idp-entity-id "<need to get from IdP side, like Azure AD or so>" set idp-single-logout-url "<need to get from IdP side, like Azure AD or so>" set idp-single-logout-url "<need to get from IdP side, like Azure AD or so>" set idp-cert "<cert which need to be imported on FG, base64, remote certificate>" set user-name username set group-name groups <---> this request additional configuration on Azure AD on claim group side> end

2) Setup User Group config user group edit "<group on FG side>" set member "azure" config match edit 1 set server-name "azure" set group-name "<group on IdP side if you want fine granularity>" next end

3)

creating Firewall Rules on FG side for allowing SSO

Some of usefull links

FortiGate SSL VPN with Azure MFA using SAML (ultraviolet.network)

https://sites.google.com/frellsen.se/kimfrellsen/fortinet-ssl-vpn-with-okta-mfa-using-saml?authuser=0

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/750526/cli-commands-for-saml-sso

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/fortigate-ssl-vpn-tutorial

What I found as an issue is that when you configure, there are some FortClients which are compatible with it and those which are not, depending on FG version firmware and appliance

Good luck.

Regards,

Dragan

I've run through many tutorials and even have it working on another 60F, but my primary firewall will never show the SSO login option when you browse to the SSL VPN page.  It's running 6.4.8 and the only reason I can think of is this unit is running central NAT and there's some sort of bug.  Did anyone have an issue with the SSO option not appearing and get around it?