Technical Tip: FortiPAM SAML authentication with Azure as IdP

[rbraha]

Description

This article describes how to configure SAML authentication using Azure as IdP.

Scope

FortiPAM.

Solution

The SAML authentication has been deployed since FortiPAM 1.0 version.

This document will focus on SAML Authentication with Microsoft Azure as the SAML IDP.

Additionally, multiple-group can be used to authenticate users in FortiPAM.

Configuration Steps for Microsoft Azure SAML Application.

Note.

This configuration assumes users and groups are already created in Azure.

1. 'Create your own application' in Azure and define a name for it:

Figure 1. Create your own application Azure

2. Once the application is deployed, assign users and groups created before as desired:

   Figure 2. Adding user/groups

3. Configure the Single Sign On URLs for the newly created SAML Application.

   Figure 3. Basic SAML Configuration

4. Configure the Attribute and Claims for the newly created SAML Application.

When editing Attribute & Claim, make sure that the username claim name has value: 'user.userprincipalname' and group claim has the value: 'user.groups'.

However, the claim name must match with 'user-name' and 'group-name' attributes/claims configured in FortiPAM.

Figure 4. Creating Attributes & Claims

Note.

Claim names are case-sensitive attributes.

5. Username claim details.

   Figure 5. Username claim details

6. Group claim details.

   Figure 6. Group claim attribute

7. Download the certificate in Base64 format to be imported later on to FortiPAM.

   Figure 7. Download IdP certificate

Configuration steps in FortiPAM.

1. Import the IdP certificate as downloaded in the previous step 7.

Go to Sytem-Certificates-Create/Import -> Remote Certificate.

Figure 8. Import IdP certificate on FortiPAM

2. Create a new Single Sign-On server matching the IdP settings configured previously in Azure.

   Figure 9. Create SSO in FortiPAM

Enable SAML authentication on FortiPAM.

config system global 

    set saml-authentication enable

end

3. Create a remote SAML group on FortiPAM.

Go to User Management -> User Groups -> Create. 

Figure 10.Creating Saml Group in FortiPAM

4. Create a SAML user on FortiPAM

Go to User Management -> User Lists -> Create.

Note: Enable Force SAML login for new users created.

Figure 11. Create SAML user

5. Results from authentication.

   Figure 12.User authenticated

Troubleshooting debug commands on FortiPAM CLI:

diagnose debug console timestamp enable
diagnose debug app samld -1
diagnose wad debug enable category auth
diagnose debug app fnbamd -1
diagnose debug enable