Description
This article describes how to enable the use of a google enterprise account for VPN authentication.
Scope
FortiGate, G Suite.
Solution
- This is a basic configuration that will allow all users with valid credentials to log in.
- All the users should have 2FA enabled on Google before configuring this.
When 2FA is in use, need to increase the remoteauthtimeout to 60 seconds, as the default 5 seconds can be too fast when two-factor authentication is in use.
config system global
set remoteauthtimeout 60
end
3. Use group filtering (optional).
Demo with WebMode:
Start from the Google admin console:
Copy 'SSO URL', and 'Entity ID' and download the certificate.
Service Provider Details:
ACS URL: https://<FGT-pub-IP>:<port-ssl-vpn>/remote/saml/login/
Entity ID: http://<FGT-pub-IP>:<port-ssl-vpn>/remote/saml/metadata/
Start URL = to ACS URL
Example:
Attribute Mapping:
Optional: Specify additional attributes and group.
For example: To use group-name in G-Suite, using the Department field and the value can be the Groupname.
To assign the value for the Department field on G-Suite, go to Directory -> Users -> Edit User -> User Information.
Assign, for example, IT value using attributes mapping Department = Groupname, 'IT' will be the Group name.
Note:
Attributes are case-sensitive and must match both SP and IdP sides.
Enable User access:
FortiGate Configuration:
Some images have the username or group name field with capital letters and may not match the config.
In the configuration, keep it consistent. e.g. If 'username' is set in google cloud user 'username' in config and not 'Username'.
Import the Google cert that was downloaded.
System -> Certificates -> Create/Import -> Remote Certificate
Customize the configuration:
idp-entity-id -> 'Entity ID' copy form google console
idp-single-sign-on-url -> 'SSO URL' copy form google console
idp-single-logout-url -> "https://accounts.google.com/logout"
### user saml ###
config user saml
edit "gsuite-sslvpn"
set cert "Fortinet_Factory"
set entity-id "http://<FGT-pub-IP>:<port-ssl-vpn>/remote/saml/metadata/"
set single-sign-on-url "https://<FGT-pub-IP>:<port-ssl-vpn>/remote/saml/login/"
set single-logout-url "https://<FGT-pub-IP>:<port-ssl-vpn>/remote/saml/logout/"
set idp-entity-id "https://accounts.google.com/o/saml2?idpid="
set idp-single-sign-on-url "https://accounts.google.com/o/saml2/idp?idpid="
set idp-single-logout-url "https://accounts.google.com/logout"
set idp-cert "REMOTE_Cert_1"
set user-name "username"
# OPTIONAL # set group-name "group"
set digest-method sha1
next
end
And to use group-name.
config user saml
edit "Your_SAML"
set group-name "Groupname"
end
config user group
edit "GOOGLE-SAML-GROUP"
set member "Your_SAML"
config match
edit 1
set server-name "Your_SAML"
set group-name "IT"
next
end
next
end
As some links contain a special character (GOOGLE IDP links containing '?') and cannot copy/paste the SAML configuration in CLI, as it will break the link as a special character will be missing.
To fix:
The first way: via SSH (GUI CLI Console – do not do the trick and must use SSH).
If the link has a value '?' in the string, then enter the value '?' in the CLI, and enter 'Ctrl + V' before '?'.
Here is an example: set idp-entity-id https://accounts.google.com/o/saml2?idpid=TENANT_ID_NUMBER
to copy/paste: set idp-entity-id https://accounts.google.com/o/saml2 <CTRL+V and use '?'> then copy/paste idpid=TENANT_ID_NUMBER
Second way: correct missing characters via GUI or configure it from the GUI (configure the SAML in the GUI starting from FortiOS 7.0+).
Go to 'Single Sign-On' -> Edit 'Your SAML' and make the proper changes in the strings that are missing characters.
### Group ###
config user group
edit "saml_gsuite"
set member "gsuite-sslvpn"
next
end
### SSL SETTINGS ###
config vpn ssl settings
set servercert "Fortinet_Factory"
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set port 4434
set source-interface "port2" "port7"
set source-address "all"
set source-address6 "all"
set default-portal "full-access"
config authentication-rule
edit 1
set groups "saml_gsuite"
set portal "full-access"
next
end
end
Firewall Rule Example:
FortiClient Configuration:
Troubleshooting Related Article:
