SAML sso for owa?

[sepdavid]

Hello 

i see there is agent for owa to enable 2FA.

is there an option to configure owa for saml sso ? 

[aahmadzada]

Hi, 

Please clarify your question as it is a bit hard to understand what you would like to achieve.

[sepdavid]

Hi 

 i want to achieve sso saml login to owa.

from my internal subnet if a user already logged in to one of the other enterprise SAML apps (browser already have the cockie ) i expect him to automatic login to owa without the need to type username and password.

if its the first SAML site he login this morning i expect him to type user&password without token because he is inside trusted network.

if the user is at home, not in our trusted network i want him to type the user password and forti token code.

[aahmadzada]

Can you please tell me where are the Fortitokens are deployed?
Are they deployed on the Fortigate or on Fortiauthenticator?

[sepdavid]

users from AD 

tokens from Fortiauthenticator

AD is a realm in Fortiauthenticator

[aahmadzada]

Ok, now it is more or less clear.

I will not be able to tell which exact steps you should take, but one hint is that the
Fortiauthenticator should be configured as an iDP.
https://docs.fortinet.com/document/fortiauthenticator/6.4.1/administration-guide/817031/saml-idp

[Debbie_FTNT]

Hey sepdavid,

principally, you can do SAML authentication if you can redirect your OWA application to FortiAuthenitcator, so it can act as IdP.

It would depend if you can configure OWA accordingly; the OWA agent is a small independent program that is run on the Exchange server and doesn't require much (if any) additional configuration on OWA side, and there is no agent for SAML authentication.

[jamescarell2021]

Hi David, 

You can use miniOrange to implement SSO and MFA in OWA and your Fortinet VPN.