Technical Tip: Configuring FortiGate SSO Administrators with ADFS as SAML IdP

[CarlosColombini]

Description

This article describes the configuration steps to allow Single Sign-On for FortiGate Administrators using ADFS as SAML IdP.

Scope

FortiGate v6.2.3 and later.

Solution

SAML is widely used as an authentication method for SSL VPN on FortiGate, and it can also be leveraged to provide Administrators with Single Sign-On.

This article will focus on the configuration steps of FortiGate and Microsoft ADFS.

1. Download the ADFS Token Signing Certificate by Navigating to ADFS -> Service -> Certificates. 'Right-click' on the Toke-signing certificate and select 'View Certificate...'

2. From the 'Details' tab select 'Copy to File...' and follow the prompts to export the certificate that will be imported to FortiGate.

3.  Import the ADFS certificate to FortiGate. Make sure this is performed in the Global VDOM if multi-vdom mode is enabled.

4. Navigate to System -> Settings and select 'Security Fabric Settings', then 'Single Sign-On Settings'.

5. Make a note of the 'Federation Service Name' and 'Federation Service Identifier' that may be used in steps 13 and 14.

Note.

Federation Service Name will be the domain of the IdP login and Logout URLs configured in FortiGate.

6. Filling out the 'SP address' field will automatically populate the SP URLs. Those can be viewed by expanding 'SP Details'.

Note.

The IdP single logout URL has the following string prepended to the domain '/adfs/ls/?wa=wsignout1.0'

Configuration from CLI:

config system saml

    set status enable

    set default-profile "super_admin"

    set cert "fgt1_admin_sso"

    set binding-protocol post

    set idp-entity-id "http://adfs.colombas.lab/adfs/services/trust"

    set idp-single-sign-on-url "https://dc1.colombas.lab/adfs/ls/"

    set idp-single-logout-url "https://dc1.colombas.lab/adfs/ls/?wa=wsignout1.0"

    set idp-cert "G_REMOTE_Cert_2"

    set server-address "fgt1-admin.colombas.lab:4444"

end

7. In ADFS Management, expand 'Trusts Relationships' and 'right-click' on 'Relying Party Trusts' and select 'Add Relying Party Trust...'.

8.  Select Start and 'Enter data about the relying party manually'.

9. Alternatively, the command 'diagnose sys saml metadata' can be used to retrieve SAML metadata.

Copy only the content between the lines ************ SP Metadata ************ and ************ IDP Metadata ************, and save to a file in XML format.

Select 'Import data about the relying party from a file' and click on 'Browse...'.:

10. Specify a name for this Relying Party and select 'Next'.

11. If the SAML Metadata file was used. Skip to step 15, otherwise continue from here and make sure to follow steps 24 and 25. Select 'AD FS Profile'.

12.  Select 'Browse...' and navigate to the certificate file downloaded from FortiGate in step 6.

 

13. Select 'Enable support for the SAML 2.0 Web SSO protocol' and paste the SP ACS URL from step 6.

14. Paste the SP Entity ID URL from step 6 and select 'Add'.

15. Optionally, the MFA can be configured at this step.

16. FortiGate does not support group attributes in SAML Assertions for Administrators. Keep this setting for now and fine-tune it in steps 22 and 23 if needed.

1. Review the settings from each tab and select 'Next'. 

Note.

When using the SAML Metadata file, the tabs Identifiers, Encryption, Signature, and Endpoints are already configured.

18. Select 'Close' to edit the 'Claim Rules'.

19. In the 'Issuance Transform Rules' tab, select 'Add Rule...'.

  

20. Keep the default option 'Send LDAP Attributes as Claims' and select 'Next'.

21. Specify a name for the rule, select 'Active Directory' for the Attribute store, and define the attributes as per below.

22. If needed, specific AD groups can be selected to limit access to FortiGate via ADFS. Delete the rule created by the Wizard.

23.  Create a new 'Issuance Authorization Rule' based on an unqualified group name.

24.  FortiGate only supports SHA1 for the Signature Algorithm for the SAML Assertions, and ADFS enforces SHA256  by default. Select the Relying Party and select 'Properties'. Navigate to the 'Advanced' tab and select SHA1 from the dropdown menu.

25. If the SAML Metadata file was not used in step 9, upload the FortiGate certificate downloaded from step 6 and follow step 26. Select the Relying Party and select 'Properties'. Navigate to the 'Signature' tab and select 'Add..' to browse to the certificate file.

26. Select the Relying Party and select  'Properties'. Navigate to the 'Endpoints' tab and select 'Add SAML...'. Select 'SAML Logout' for Endpoint type, 'POST' or 'Redirect' for Binding, and paste the 'SP SLS URL' from step 6 into 'Trusted URL'..