Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ck8882
New Contributor II

is it support and how do configure FMG as an Identity Provider (IdP), FGT as an SP role for sslvpn

HI,

 

I would like configure FortiManager as an Identity Provider (IdP), FortiGate as an SP role for sslvpn. May i know is it supported?

 

I did configured FGT as SP from the " User & Authentication > Single Sign-On", also configured fortimanager as IDP  from "system setting > Admin > SAML SSO. FMG SAML Attributes is default "username". However, when i try to connect sslvpn, there is unsuccessful connect, just hang in the forticlient screen. I also tried to login via web access, however still hang on loading sslvpn login page.

 

I found out a article about FMG as IDP below, however there is no much information can found configure FGT FortiManager as an Identity Provider (IdP), FortiGate as an SP role for sslvpn

 

https://community.fortinet.com/t5/FortiManager/Technical-Tip-SAML-SSO-user-group-setup-for-a-managed...

 

Please advise and share if anyone experience it.

 

Thanks

 

4 REPLIES 4
hbac
Staff
Staff

Hi @ck8882,

 

As mentioned in the article you provided, you can configure FortiManager as an Identity Provider (IdP). Please double check the settings and make sure all URLs are matching on FortiManager and FortiGate. 

 

Regards, 

ck8882
New Contributor II

Hi @hbac 

 

I have checked the setting and URL is correct between FortiManager and FortiGate.

 

You may Please take a look screenshot below. anything else config i did missing? also there is error from forticlient or web access page.

 

Could you assist it??

 

Thanks

 

error.JPG

FMG.JPGFGT1.JPGFGT2.JPGFGT3.JPGFGT4.JPG

Sheikh
Staff
Staff

Hello @ck8882 

 

Install 'SAML tracer' extension in browser and try to open a web page. this might give you some clue about your problem.


You can also collet .HAR file from browser (development tools), while reproducing issue.

 

regards,

 

Sheikh

**If you come across a resolution, kindly show your appreciation by liking and accepting it, ensuring its accessibility for others**
ck8882
New Contributor II

Would like to confirm the SAML user should create in FMG - IDP or FGT - SP?

 

Thanks

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors