SSLVPN SAML with Google IDP

It works! So you must use group matching.

The beautiful part is you can create a custom schema in Google just for Fortinet portals and pull that through the SAML attribute. 

Make sure your config user saml is the same as your attribute in Google so..

config user saml

edit "Google" set entity-id "https://gateway.xxxxx.com/remote/saml/metadata" set single-sign-on-url "https://gateway.xxxxx.com/remote/saml/login" set single-logout-url "https://gateway.xxxxx.com/remote/logout" set idp-entity-id "https://accounts.google.com/o/saml2?idpid=C011xxxxx" set idp-single-sign-on-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-single-logout-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-cert "REMOTE_Cert_1" set user-name "Email" set group-name "Memberof" next

In Google

Attribute Mapping

Email - Basic Information - Primary Email

Memberof - CustomSchema - your_custom_schema_field

In Fortigate

config user group edit "studnetSAML" set group-type firewall set authtimeout 0 set auth-concurrent-override disable set http-digest-realm '' set member "Google" config match edit 1 set server-name "Google" set group-name "your_custom_schema_field" next end

You must ALSO create a firewall group for each individual group mapped to a portal.