SSL-VPN - SAML login more groups

[daemon]

Could someone please advise me. I have setup SSO login for SSL-VPN via AAD, but in AAD I have groups for example finance and tech support, but in fortigate I have it all as one group azure - Remote sso, problem is I need different rules for finance and different for tech support, how to make me use SSO, but have multiple groups in fortigate and the female from finance don't have access everywhere like tech support. Thank you for your help!

[ndumaj · Accepted solution]

Hello,
Please find below some links that might help:

Configure Fortigate SSL VPN to use Azure AD as SAML IDP (MFA / Conditional Access)
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-SAML-SSO-login-for-FortiGate/t...

According to Microsoft Azure documentation:

The number of groups emitted in a token is limited to 150 for SAML assertions and 200 for JWT, including nested groups. In larger organizations, the number of groups where a user is a member might exceed the limit that Azure AD will add to a token. Exceeding a limit can lead to unpredictable results. For workarounds to these limits, read more in Important caveats for this functionality.

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-fed-group-cla...

To further investigate the debug log should provide more info:

diagnose debug application samld -1

diagnose debug application sslvpn -1

diagnose debug enable
 

BR

[daemon]

There was a mistake in the claims attributes, now everything works as it should.

[ndumaj]

Hello Daemon,

Happy to hear that your issue is resolved.

BR