Best ZTNA authentication

[sikhanegi]

Which tags would be best if we have users with FortiClient + EMS that connect to our datacenter to our RDS cluster(s)?

What is the best way to authenticate them? SAML SSO? Ztna tags? Certificate based?

[AEK]

1. The certificate authentication is already included for registered clients.
2. In addition ZTNA tags is also good to identify AD group and to filter accordingly.
3. And if you want SSO and your target apps supports it then you can use SAML in addition.

As conclusion you can you can combine all of the above: The 1st for host authentication (cannot be removed). The 2nd to filter according to user/group identification. And the 3rd for SSO.