Technical Tip: Set up SAML admin LDAP login on FortiGate (SP) with FortiAuthenticator (IDP)

kiri · ‎12-31-2022

Description

This article describes how to configure FortiGate to accept admin logons over SAML with LDAP credentials.

Scope

FortiAuthenticator 6.X.
FortiGate 6.2, 6.4, 7.X.

Solution

In FortiAuthenticator, configurations are located under SAML ldP -> General. Follow the steps below:

Enable the SAML Identity Provider portal.
Set either an IP or FQDN (preferred) server address and a prefix.
Select the correct realm. In this case, select LDAP.
Create a remote group. Add users/admins and a filter for the group.

Download the IDP server certificate highlighted above under Certificate Management -> End Entities -> Local Services.
Create an SP, under SAML ldP -> Service Providers:

Add the following claim, filling in details as necessary:
SAML attribute: 'username'. This attribute is hardcoded on the FortiGate, it needs to be configured only on the IDP side.
User attribute: Remote LDAP Server: samAccountName (or Username attribute: configured in Auth, Remote Auth Servers, LDAP).

Follow the steps below in FortiGate:

Enable SSO Admin login.
For the IdP address, provide the IP or FQDN (preferred) and a prefix. The details should be the same as configured in step 2.
Upload the certificate downloaded in step 4. The setting is located under Security Fabric -> Fabric connectors -> Security Fabric Setup -> edit -> Single Sign-On Settings.

Alternatively, run the following in the CLI (the details provided are examples):

config system saml
set status enable
set default-profile "super_admin"
set idp-entity-id "http://fortiauth.local/saml-idp/fgtadm/metadata/ "
set idp-single-sign-on-url "https://fortiauth.local/saml-idp/fgtadm/login/ "
set idp-single-logout-url "https://fortiauth.local/saml-idp/fgtadm/logout/ "
set idp-cert "fortiauth.local_SAN"
set server-address "10.191.19.149:4443"

end
Logout from FortiGate, refresh, select the SSO option, and auth with LDAP credentials on FortiAuthenticator (IDP):
Login to the firewall as an SSO admin. If the steps are completed, this will succeed.
At the time of writing, SAML SSO-admin authentication at VDOM level is not supported: it is only supported at global level. As a workaround, these steps can be performed (where appropriate):
1. If possible, set FortiGate's SSO URL to an FQDN and use DNS to point to different VDOM IPs to make some users hit the FortiGate with different IPs using the same FQDN.
2. Add VDOM to admin account's VDOM list, (not ideal if permission is a problem).
3. Change the SSO URL to the VDOM's IP that is needed. Refer to this article on how to resolve two different IPs per FQDN.