how to specify a FAC group for Fortigate administrator login

[nplljw]

Hello, I would like to know how to use FortiAuthenticator to configure saml SSO login for Fortigate administrators, and how to specify a FAC group for Fortigate administrator login

[dingjerry_FTNT · Accepted solution]

Hi @nplljw ,

1) Configure SAML settings on FortiAuthenticator

https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/164528/configure-saml-settings-...

2) Please also check this KB:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Set-up-SAML-admin-LDAP-login-on-Fortigate-...

[pminarik]

FortiGate currently does not support group-based or wildcard-admin-based administrator logins with SAML. All authentication is individual, per-user. No support for dynamic VDOM assignment or access profile assignment either.

Restrictions as to who can authenticate can only be imposed from the IdP side. Unfortunately, FortiAuthenticator only allows configuring group-based restrictions on the "global level" for SAML (SAMl IdP > General), not on a per-SP basis. But maybe that will suffice for you?