SAML config for VPN SSL

[AlexBeaudet]

Hi,

I'm trying to configure SAML for our VPN SSL and can't seem to get it off the ground.

Read many KBs but no matter how I set it up I cannot even get the metadata page to show!

Fortigate 6.4.3

Config used so far

config user saml     edit "uqtr.sso.saml"         set cert "Fortigate2020"         set entity-id "https://publicIPofFortigate/remote/saml/metadata"         set single-sign-on-url "https://publicIPofFortigate/remote/saml/login"         set single-logout-url "https://publicIPofFortigate/remote/saml/logout"         set idp-entity-id "https://login.microsoftonline.com/b67129f2-c591-4816-b477-d36123123369309/saml2"         set idp-single-sign-on-url "https://sts.windows.net/b67129f2-c591-4816-b477-d312312369309/"         set idp-single-logout-url "https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0"         set idp-cert "REMOTE_Cert_1"         set user-name "username"     next end

If I try to access the https://publicIPofFortigate/remote/saml/metadata URL it says web page cannot be found.

If I set it to "private IP addresses" inside our network I have an Error page.

Is there anything I need to activate on my Fortigate for this SAML SP setup to get going? Couldn't find any detail that I might have missed. 

I enabled HTTPS on the public and private interfaces of the Fortigate.

thanks for any input!

[bubikaj]

Hi,

you need to configure several things but before you need to identify who will be IdP and who will be SP

In scenario that you are using Azure AD as IdP you need to add under Enterprise application FortiGate SSL VPN solution and add users which need to have access to VPN. Also you can create separate Azure AD group for fine granular separating but in that case you need to add them via CLI on FortiGate.

You need to configure on FG side group and saml user. Saml user is this what you created, it is like object which is pulling data from IdP (Identity Provider).

 1) Setup SAML

config user saml edit azure set entity-id "https://<PublicIP_or_FQDN>:<portIfItIsNot:443>/remote/saml/metadata" set single-sign-on-url "https://<PublicIP_or_FQDN>:<portIfItIsNot:443>/remote/saml/login" set single-logout-url "https://<PublicIP_or_FQDN>:<portIfItIsNot:443>/remote/saml/logout" set idp-single-sign-on-url "<need to get from IdP side, like Azure AD or so>" set idp-entity-id "<need to get from IdP side, like Azure AD or so>" set idp-single-logout-url "<need to get from IdP side, like Azure AD or so>" set idp-single-logout-url "<need to get from IdP side, like Azure AD or so>" set idp-cert "<cert which need to be imported on FG, base64, remote certificate>" set user-name username set group-name groups <---> this request additional configuration on Azure AD on claim group side> end

2) Setup User Group config user group edit "<group on FG side>" set member "azure" config match edit 1 set server-name "azure" set group-name "<group on IdP side if you want fine granularity>" next end

3)

creating Firewall Rules on FG side for allowing SSO

Some of usefull links

FortiGate SSL VPN with Azure MFA using SAML (ultraviolet.network)

https://sites.google.com/frellsen.se/kimfrellsen/fortinet-ssl-vpn-with-okta-mfa-using-saml?authuser=...

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/750526/cli-commands-for-saml-sso

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/fortigate-ssl-vpn-tutorial

What I found as an issue is that when you configure, there are some FortClients which are compatible with it and those which are not, depending on FG version firmware and appliance

Good luck.

Regards,

Dragan

[AlexBeaudet]

Thank you for your reply.

I have done all of that and still nothing seems to work.

My first step is trying to get the metadata with the following URL

https://fortigateIP/remote/saml/metadata

Either from the LAN or WAN I get the following message :

I was expecting to get the XML metadata from that URL.  If I setup SAML SSO for admin login on my FortiManager the metadata page works correctly on the LAN and displays the XML page. I was expecting a similar behaviour from the other URL.

the SAML user and group are setup along with a firewall policy for the SSL VPN referencing the group.

Its as if a global "enable" is missing somewhere for the URLs to be available.

[useradmn]

I've had the same issue. I've got a ticket open for this same exact issue. There appears to be a bug that its getting resolution, per Fortinet's senior engineers. 

[AlexBeaudet]

Good to know! thank you.

[Tifoso]

It seems I have a similar problem. what was the reason for this problem and how this can be solved?

[svemuri]

Recently went through similar thing and came across this thread.  I successfully configured SAML for admin login and SSL VPN and wanted to add a few notes here for future reference.

The IDP/SP IDs are just URIs.  There doesn't have to by any metadata xml at that URL.  They are simply used as identification tokens between IDP and SP.  Note that they must match EXACTLY (including trailing slashes etc) and this was my issue.

On SSL VPN config, I accidently set idp-id and login-url to same (to idp id).  I changed it once I realized it.  However, it appears that it got "stuck" somehere and login was still being sent to sts.windows.net, which of course was not going to work.  This is in 6.4.6.  I deleted the entire config, rebooted and reconfigured and it seems to work.

Moral of the story is that one needs to pay attention to IDP/SP ID URIs and login/logout/reply URLs carefully.

The following links helped:

SSLVPN with Azure SAML | Fortinet Technical Discussion Forums

Azure Administration Guide | FortiGate Public Cloud 6.4.0 | Fortinet Documentation Library

Configuring SAML SSO login for FortiGate administrators with Azure AD acting as SAML IdP (fortinet.c...

Hope this helps.

[LR]

I've run through many tutorials and even have it working on another 60F, but my primary firewall will never show the SSO login option when you browse to the SSL VPN page.  It's running 6.4.8 and the only reason I can think of is this unit is running central NAT and there's some sort of bug.  Did anyone have an issue with the SSO option not appearing and get around it?

[Debbie_FTNT]

Hey LR,

usually, the SSO option doesn't show if SAML is not included in any policies for SSLVPN.
Can you check the following?
- you have a user group that includes the SAML server
- you have a portal with web-access mapped to the SAML user group in SSLVPN settings

- you have included the SAML user group in at least once policy from ssl.root (or ssl.<vdom>) to whatever destination?

[LR]

Yes, I have all those and I've made it work on a 60F running default profile-based NGFW.  The unit I cannot get the SSO login to appear is running policy-based NGFW and central NAT.