Could someone please advise me. I have setup SSO login for SSL-VPN via AAD, but in AAD I have groups for example finance and tech support, but in fortigate I have it all as one group azure - Remote sso, problem is I need different rules for finance and different for tech support, how to make me use SSO, but have multiple groups in fortigate and the female from finance don't have access everywhere like tech support. Thank you for your help!
Hello,
Please find below some links that might help:
Configure Fortigate SSL VPN to use Azure AD as SAML IDP (MFA / Conditional Access)
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-SAML-SSO-login-for-FortiGate/ta-p/194656
According to Microsoft Azure documentation:
The number of groups emitted in a token is limited to 150 for SAML assertions and 200 for JWT, including nested groups. In larger organizations, the number of groups where a user is a member might exceed the limit that Azure AD will add to a token. Exceeding a limit can lead to unpredictable results. For workarounds to these limits, read more in Important caveats for this functionality.
To further investigate the debug log should provide more info:
diagnose debug application samld -1
diagnose debug application sslvpn -1
diagnose debug enable
BR
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
