Created on 01-06-2021 11:59 PM Edited on 12-22-2024 10:59 PM By Anthony_E
Description
This article describes how to use Okta as the SAML IdP for FortiGate GUI access. Optionally enable Multi-Factor Authentication.
Scope
FortiGate v6.2+ Web Administration and Okta.
Solution
Unlike SAML configuration for users in FortiGate, SAML configuration for administrators does not accept custom settings for SP configuration. Because of that, starting the configuration from Okta is recommended.
Okta Configuration Steps:
Log in to Okta portal as an Administrator to create and configure the SAML Application
Single sign on URL: https://<FGT IP or FQDN>:<ADMIN PORT>/saml/?acs
Audience URI (SP Entity ID): http://<FGT IP or FQDN>:<ADMIN PORT>/metadata/
Name ID format: EmailAddress
Application username: Email
Note.
What is defined under 'server-address' in CLI or 'SP Address' in GUI will define what is needed to be typed in '<FGT IP or FQDN>:<ADMIN PORT>'
If port 443 is set for FortiGate's HTTPS admin, then omit :<ADMIN PORT>. For example, it should look like below:
Single sign on URL: https://<FGT IP or FQDN>/saml/?acs
Audience URI (SP Entity ID): http://<FGT IP or FQDN>/metadata/
In the example below, Administrator access FortiGate via FQDN colombasfgt1.ddns.net and port 5555.
Note.
Pay close attention at the Audience URI (SP Entity ID). It starts with 'http' and not 'https'. Additionally, there is a trailing forward slash.
However attribute name must be 'username', which is the only one FortiGate will accept
'Group Attribute' is irrelevant and should be left empty.
Select 'Assign' for the desired group or user, then select 'Done'.
A new browser tab opens. Make a note of the 'Identity Provider Single Sign-On URL', and 'Identity Provider Issuer', and download the certificate to be imported to FortiGate.
The next steps will be done as per below.
FortiGate Configuration Steps:
Import Okta certificate to FortiGate.
From CLI Console run the following commands.
SIGMA # config vpn certificate remote
SIGMA (remote) # rename REMOTE_Cert_1 to Okta-Admin
SIGMA (remote) # end
Note.
To prevent a loop issue after logging out, define the 'IdP single logout URL' with the Web Admin URL.
CLI Configuration:
config system saml
set status enable
set default-profile "super_admin"
set idp-entity-id "http://www.okta.com/exk5bw0crfdgnwCzL5d7"
set idp-single-sign-on-url "https://dev-5027942.okta.com/app/dev 5027942__1/exk5bw0crfdgnwCzL5d7/sso/saml"
set idp-single-logout-url "https://colombasfgt1.ddns.net:5555"
set idp-cert "Okta-Admin"
set server-address "colombasfgt1.ddns.net:5555"
end
Okta Multifactor with Okta Verify method.
Add a rule to Default or new policy, and make sure 'Prompt for Factor' is enabled.
Verification of configuration.
Troubleshooting.
Enable debugs for the SAML process with the commands below, then perform the login attempt.
diagnose debug console timestamp enable
diagnose debug application samld -1
diagnose debug enable
Related article:
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.