SSLVPN SAML with Google IDP

[pmit]

SSLVPN SAML is working in 6.4 with Google IDP

config user saml edit "Google" set entity-id "https://gateway.xxxxx.com/remote/saml/metadata" set single-sign-on-url "https://gateway.xxxxx.com/remote/saml/login" set single-logout-url "https://gateway.xxxxx.com/remote/logout" set idp-entity-id "https://accounts.google.com/o/saml2?idpid=C011xxxxx" set idp-single-sign-on-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-single-logout-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-cert "REMOTE_Cert_1" set user-name "Email" set group-name "Memberof" next end

Make sure you have local users with full email address for user name in Fortigate.

Google setup is simple.

ACS

https://gateway.XXXXX.com/remote/saml/login

Entity ID

https://gateway.XXXXX.com/remote/saml/metadata

Start URL

https://gateway.XXXXX.com/remote/saml/login

NameID - Basic Info - Primary Email

Name IF Format - Email

[pmit]

Seems to be no easy way to separate groups though. Fortigate treats every SAML user as the same group, so you cannot assign different SSL portals or policy! At least this is what I've found so far. 

[pmit]

It works! So you must use group matching.

The beautiful part is you can create a custom schema in Google just for Fortinet portals and pull that through the SAML attribute. 

Make sure your config user saml is the same as your attribute in Google so..

config user saml

edit "Google" set entity-id "https://gateway.xxxxx.com/remote/saml/metadata" set single-sign-on-url "https://gateway.xxxxx.com/remote/saml/login" set single-logout-url "https://gateway.xxxxx.com/remote/logout" set idp-entity-id "https://accounts.google.com/o/saml2?idpid=C011xxxxx" set idp-single-sign-on-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-single-logout-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-cert "REMOTE_Cert_1" set user-name "Email" set group-name "Memberof" next

In Google

Attribute Mapping

Email - Basic Information - Primary Email

Memberof - CustomSchema - your_custom_schema_field

In Fortigate

config user group edit "studnetSAML" set group-type firewall set authtimeout 0 set auth-concurrent-override disable set http-digest-realm '' set member "Google" config match edit 1 set server-name "Google" set group-name "your_custom_schema_field" next end

You must ALSO create a firewall group for each individual group mapped to a portal.

[ted_barker]

!! thanks for sharing