Track username via SAML Fortiweb

[rafaelrosseto88]

Hello,

Is there a way to track the username from a session authenticated through SAML Azure IDP when accessing a specific VIP using Site Publish?

Should the username be automatically received via Site Publish, or do I need to create a tracking rule for this purpose?

[Jean-Philippe_P]

Hello rafaelrosseto88, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

@AEK @sw2090 @pminarik @ebilcari do you have an idea about this issue, please?

[Khidzir_MN · Accepted solution]

Hi rafaelrosseto88,

Hope you're doing well.

You may need to add below Attributes mapping (UPN - EPPN) in the SAML Azure IdP. Below sample is for SAML Microsoft Entra ID.

The FortiWeb will show the respective Username for the respective Traffic Log.

You may also enable the Alert Type option for the respective Site Publish Rule to show the respective Username in the Event Log.

Offloaded authentication and optional SSO configuration

Hope this helps.

Thank you.
Khidzir

[vollmado]

Hi Khidzir_MN,

thanks for the reply - but how is this done on FortiAuthenticator as IDP. I added the following but this does not work as expected.

I also tried it with "Username".

BR

Dominik

[Jean-Philippe_P]

Hello,

The full KB article for this topic can be found there: https://community.fortinet.com/t5/FortiWeb/Technical-Tip-How-to-show-Username-for-FortiWeb-Site-Publ...

Thanks a lot, @Khidzir_MN for this good job! ;)

[rolebgo2]

Bringing this back like whoa, apparently FortiWeb 7.0.2 was that missing piece. Fortinet had this as a bug and, sure enough, admin GUI SSO through Azure AD is working like a champ now. Hope this helps someone out there.