VPN SSL: have both LDAP Authenticaton and Azure SAML Authentication

[gsommariva]

hello,

On a Fortinet vdom I need to migrate current SSL VPN with LDAP Auth to Azure SAML Auth.

There are LDAP Auth UserGruups, every UserGroup is mapped to a single VPN SSL Portal.

What I need to achieve is to set up Azure SAML Auth and map new User Groups to the same VPN Portals.

UserGroup-1-LDAP -> Portal-VPN-SSL-1
UserGroup-1-SAML-AZURE -> Portal-VPN-SSL-1

Is it possible without compromise or modify actual VPN SSL Portal configuration?

Thanks a lot,

Graziano

[funkylicious · Accepted solution]

Hi, 

Basically, yes.

You can use the same SSLVPN Portal, which by the way only has settings in regards to which IP Pool to get an IP assigned to the user, if it's split or full tunnel and other settings like that.

After you configure the SAML, config user saml , you then need to assign it to a User Group.

It has to be a different User Group from that in which you have LDAP configured ( you cannot have 2 remote auth servers in the same one, as far as I know or you cant have 2 of the same remote auth in the same user group ) .

Then, you would need to add the user group in SSLVPN settings to a portal, then configure the firewall rules with this new user group.

Just to make sure that when a user tries to login it uses the correct auth method, SAML and not LDAP, i would also create a separate realm and define that realm alongside the User group and portal in the settings.

[funkylicious · Accepted solution]

Hi, 

Basically, yes.

You can use the same SSLVPN Portal, which by the way only has settings in regards to which IP Pool to get an IP assigned to the user, if it's split or full tunnel and other settings like that.

After you configure the SAML, config user saml , you then need to assign it to a User Group.

It has to be a different User Group from that in which you have LDAP configured ( you cannot have 2 remote auth servers in the same one, as far as I know or you cant have 2 of the same remote auth in the same user group ) .

Then, you would need to add the user group in SSLVPN settings to a portal, then configure the firewall rules with this new user group.

Just to make sure that when a user tries to login it uses the correct auth method, SAML and not LDAP, i would also create a separate realm and define that realm alongside the User group and portal in the settings.

[gsommariva · Accepted solution]

Yes, i will setup a Realm for SAML auth.

Thanks a lot.

Graziano