Technical Tip: FortiEDR SAML IdP configuration with ADFS

[ymasaki]

Description	This article describes how to set up the SAML IdP configuration with on-prem ADFS.
Scope	FortiEDR v5.0+v and 5.2+
Solution	To set up SAML authentication in ADFS (This guide instructs the steps after ADFS installed). Go to ADMINISTRATION -> USERS and download Service Provider Metadata. **This file is required to set up Relying Party Trusts in ADFS. Open AD FS Manager and select Add Relying Party Trust. Select Claims aware and select Start. Select Import data about the relying party from a file and select the SP Metadata from Step 1. Select Next. Enter the Display name and select Next. Choose Permit Everyone and select Next. Select Next. Select Close. Select Properties. Go to the Advanced tab and enable SHA-1. Select OK. Select Edit Claim Issuance Policy and Add Rule. Select Next. Enter the Claim rule name, select Attribute store: Active Directory and add mapping of LDAP attributes for Group and Name ID. Select Finish. Select OK. Download FederationMetadata.xml (https://<your server FQDN or IP>/FederationMetadata/2007-06/FederationMetadata.xml). **This file is required to set up SAML setup in FortiEDR Central Manager. To set up SAML authentication in FortiEDR Central Manager. Go to ADMINISTRATION > USERS and fill in following fields. Select Save. SAML Enabled: Check the checkbox. IDP Description: Fill in the comments. IDP Metadata: Upload the Metadata file from ADFS (Step. 15). Attribute Name: http://schemas.xmlsoap.org/claims/Group Role/Group mapping: Enter LDAP group name for target users. Copy SSO URL. Access the SSO URL and redirect to the ADFS Sign page. Sign in with username and password. Successfully logged in as an ADFS SAML user.