Visitor III

Solved

VPN SSL: have both LDAP Authenticaton and Azure SAML Authentication

Forum|Forum|1 year ago
February 27, 2025
2 replies
896 views

hello,

On a Fortinet vdom I need to migrate current SSL VPN with LDAP Auth to Azure SAML Auth.

There are LDAP Auth UserGruups, every UserGroup is mapped to a single VPN SSL Portal.

What I need to achieve is to set up Azure SAML Auth and map new User Groups to the same VPN Portals.

UserGroup-1-LDAP -> Portal-VPN-SSL-1
UserGroup-1-SAML-AZURE -> Portal-VPN-SSL-1

Is it possible without compromise or modify actual VPN SSL Portal configuration?

Thanks a lot,

Graziano

Best answer by funkylicious

Hi,

Basically, yes.

You can use the same SSLVPN Portal, which by the way only has settings in regards to which IP Pool to get an IP assigned to the user, if it's split or full tunnel and other settings like that.

After you configure the SAML, config user saml , you then need to assign it to a User Group.

It has to be a different User Group from that in which you have LDAP configured ( you cannot have 2 remote auth servers in the same one, as far as I know or you cant have 2 of the same remote auth in the same user group ) .

Then, you would need to add the user group in SSLVPN settings to a portal, then configure the firewall rules with this new user group.

Just to make sure that when a user tries to login it uses the correct auth method, SAML and not LDAP, i would also create a separate realm and define that realm alongside the User group and portal in the settings.

funkyliciousAnswer

SuperUser

Hi,

Basically, yes.

You can use the same SSLVPN Portal, which by the way only has settings in regards to which IP Pool to get an IP assigned to the user, if it's split or full tunnel and other settings like that.

After you configure the SAML, config user saml , you then need to assign it to a User Group.

It has to be a different User Group from that in which you have LDAP configured ( you cannot have 2 remote auth servers in the same one, as far as I know or you cant have 2 of the same remote auth in the same user group ) .

Then, you would need to add the user group in SSLVPN settings to a portal, then configure the firewall rules with this new user group.

Just to make sure that when a user tries to login it uses the correct auth method, SAML and not LDAP, i would also create a separate realm and define that realm alongside the User group and portal in the settings.

"jack of all trades, master of none"

gsommarivaAuthor

Visitor III

Yes, i will setup a Realm for SAML auth.

Thanks a lot.

Graziano

Sign up

Login with SSO

Login to the community

Login with SSO