Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
telouat
New Contributor II

SAML WINDOWS INTEGRATED AUTHENTIFICATION

Hello

I am working on a subject to set up authentication for web access for a user group outside the fsso domain.
I configured SAML with Azure but I cannot set up integrated Windows authentication without going through an ADFS server.

I thought about setting up authentication with a radius but I am still facing the same problem with integrated Windows authentication

12 REPLIES 12
Jean-Philippe_P
Moderator
Moderator

Hello telouat,

 

Thanks for your post, can you precise us which version of FortiGate you have and more info on your setup, please?

 

This way it will be easier for us to help you.

 

Regards,

Jean-Philippe - Fortinet Community Team
telouat

Hi JP,

Thank you for your reply

 

This my configuration in Fortigate :

config user radius
edit "NPS"
set server "192.168.x.x"
set secret ENC rgKDAV8XLAHeZI2vqbyOt1BswHCYgyfTBOu1pUjAbHTsvR9Ft
set all-usergroup enable
set auth-type ms_chap_v2
next
end


config user group
edit "GU_NPS_Group"
set member "radius"
next
end

 

config firewall policy
edit 8
set name "LAN-auth-policy"
set uuid c1acc36e-c509-51ee-d874
set srcintf "lan"
set dstintf "wan"
set action accept
set srcaddr "test_ssl"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
set groups "GU_NPS_Group"
next
end

 

I abandoned the idea of doing SAML because I cannot deploy ADFS for integrated windows authentication.

 

my need therefore as I cannot do SAML authentication with integrated Windows SSO without going through an ADFS server, I therefore switched to a configuration with Radius NPS windows but I cannot find how to do it without the user retyping their identifier.

 

thanks

dbu

Hi @telouat , 

As per my understanding now you are trying to configure remote RADIUS server (NPS). 
have a look at this guide and verify your configuration : 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-and-Microsoft-NPS-Ra...

Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
telouat
New Contributor II

thank you for the answer, I followed this tutorial and the fortigate asks me for authentication despite everything.

 

forti.png

dbu

What happens when you test with CLI command ? Does it returns the attributes ?
I also see this value on your configuration : 
set all-usergroup enable

Can you disable this and test again . 



Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
telouat
New Contributor II

set all-usergroup disable

no change same result.

authentification test to radius is good.

 

forti.png

telouat
New Contributor II

I check de NPS Log 

The NPS server has granted access to a user with success

dbu

What happens here when you try to authenticate here ? 

Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
telouat
New Contributor II

Authentification success and I can see user session in fortigate

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors