Create SAML IDP problem

[piaakit1210]

Dear All, 

          i was trying to configuring SAML SSO login for ssl vpn with azure ad, i followed below command in fortigate and when i type next, it popup entity-id is empty, and i also have below question in green, any help would be appreicated 

1. Create SAML IDP:
   CLI command:
   conf user saml
       edit “azure-name”
   set cert "SSL-VPN settings assigned Server Certificate"  <-- any ssl cert in fortigate will do ?
     set entity-id "https://<FortiGate IP address or FQDN>:<Custom SSL VPN port>/remote/saml/metadata"
           set single-sign-on-url "https://<FortiGate IP address or FQDN>:<Custom SSL VPN port>/remote/saml/login"
           set single-logout-url "https://<FortiGate IP address or FQDN>:<Custom SSL VPN port>/remote/saml/logout"
           set idp-entity-id "<Azure AD identifier>"  <-- Identifier (Entity ID) from Basic SAML Configuration ?        set idp-single-sign-on-url "<Login URL>"
           set idp-single-logout-url "<Logout URL>"
           set idp-cert "<Certificate imported earlier>"
           set user-name "username"
           set group-name "group"
       next
   end

FortiGate-100F (Azure-name) # next
node_check_object fail! for entity-id is empty.
Attribute 'entity-id' MUST be set.
Command fail. Return code 1

piaakit

[dbu]

Hi @piaakit1210 ,

I believe you need to import the SAML IdP Certificate from the Azure. 
And yes that entity-id is set under basic SAML configuration.

Have a look at this guide as it may help with your configuration :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-SAML-SSO-login-for-FortiGate/t...

[ndumaj]

Hi,

As DBU confirmed you need to download the certificate, please review also the following article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-SSL-VPN-with-Azure-SAML-SSO-Authent...

Here you can also find a video :
Configure Fortigate SSL VPN to use Azure AD as SAML IDP (MFA / Conditional Access)
https://www.youtube.com/watch?v=nDH2wvveLrI

-BR-

[mle2802]

Hi @piaakit1210,

Did you set the command 
config user saml
  set entity-id 

For the "set cert" command, you can the cert assign in SLS VPN setting and the "set idp-entity-id" command is "Azure AD identifier" which be found under step 4 in Azure "Set up FortiGate SSL VPN" not the SAML config.

Regards,
Minh