SSL VPN with SAML (MS Azure with Authc app) AND user certificates?

[mattw]

Hi all, I have a customer that are using SAML authc with Azure for SSL VPN connections which is working well. They would like to use clients certificates as another authentication factor. Is this possible when using SAML? Many thanks in advance!

[Yurisk]

Hi, unfortunately not supported. I tried to find info in the FTNT docs to no avail, but in practice once you configure SAML, you cannot use 

config vpn ssl setting
    set reqclientcert enable 

to require client certificates. Also on Forticlient once it connects using SAML, the option to specify client certificate is grayed out.

But I'd be glad to find official docs saying this, so bookmarking this post.

[Debbie_FTNT]

Hey mattw,

I found this thread discussing the same question:

https://community.fortinet.com/t5/Support-Forum/FortiClient-Azure-SSO-with-Client-Certificate/td-p/2...

I have never tried to combine client certificates and SAML authentication myself in the way described there, so I can't say if it would work or not.

[mattw]

Thank you @Yurisk and @Debbie_FTNT, your responses are very helpful.