Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
piaakit1210
New Contributor III

Create SAML IDP problem

Dear All, 

 

          i was trying to configuring SAML SSO login for ssl vpn with azure ad, i followed below command in fortigate and when i type next, it popup entity-id is empty, and i also have below question in green, any help would be appreicated 

 

 

  1. Create SAML IDP:
    CLI command:
    conf user saml
        edit “azure-name”
    set cert "SSL-VPN settings assigned Server Certificate<-- any ssl cert in fortigate will do ?
      set entity-id "https://<FortiGate IP address or FQDN>:<Custom SSL VPN port>/remote/saml/metadata"

            set single-sign-on-url "https://<FortiGate IP address or FQDN>:<Custom SSL VPN port>/remote/saml/login"
            set single-logout-url "https://<FortiGate IP address or FQDN>:<Custom SSL VPN port>/remote/saml/logout"
            set idp-entity-id "<Azure AD identifier>"  <-- Identifier (Entity ID) from Basic SAML Configuration ?
     
            set idp-single-sign-on-url "<Login URL>"
            set idp-single-logout-url "<Logout URL>"
            set idp-cert "<Certificate imported earlier>"
            set user-name "username"
            set group-name "group"
        next
    end

 

 

 

FortiGate-100F (Azure-name) # next
node_check_object fail! for entity-id is empty.
Attribute 'entity-id' MUST be set.
Command fail. Return code 1

 

piaakit

 

3 REPLIES 3
dbu
Staff
Staff

Hi @piaakit1210 ,

I believe you need to import the SAML IdP Certificate from the Azure. 
And yes that entity-id is set under basic SAML configuration.

Have a look at this guide as it may help with your configuration :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-SAML-SSO-login-for-FortiGate/t...

 

 

Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
ndumaj
Staff
Staff

Hi,

As DBU confirmed you need to download the certificate, please review also the following article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-SSL-VPN-with-Azure-SAML-SSO-Authent...

Here you can also find a video :
Configure Fortigate SSL VPN to use Azure AD as SAML IDP (MFA / Conditional Access)
https://www.youtube.com/watch?v=nDH2wvveLrI

-BR-

- Happy to help, hit like and accept the solution -
mle2802
Staff
Staff

Hi @piaakit1210,

Did you set the command 
config user saml
  set entity-id 

For the "set cert" command, you can the cert assign in SLS VPN setting and the "set idp-entity-id" command is "Azure AD identifier" which be found under step 4 in Azure "Set up FortiGate SSL VPN" not the SAML config.

Regards,
Minh 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors