is it support and how do configure FMG as an Identity Provider (IdP), FGT as an SP role for sslvpn

[ck8882]

HI,

I would like configure FortiManager as an Identity Provider (IdP), FortiGate as an SP role for sslvpn. May i know is it supported?

I did configured FGT as SP from the " User & Authentication > Single Sign-On", also configured fortimanager as IDP  from "system setting > Admin > SAML SSO. FMG SAML Attributes is default "username". However, when i try to connect sslvpn, there is unsuccessful connect, just hang in the forticlient screen. I also tried to login via web access, however still hang on loading sslvpn login page.

I found out a article about FMG as IDP below, however there is no much information can found configure FGT FortiManager as an Identity Provider (IdP), FortiGate as an SP role for sslvpn

https://community.fortinet.com/t5/FortiManager/Technical-Tip-SAML-SSO-user-group-setup-for-a-managed...

Please advise and share if anyone experience it.

Thanks

[hbac]

Hi @ck8882,

As mentioned in the article you provided, you can configure FortiManager as an Identity Provider (IdP). Please double check the settings and make sure all URLs are matching on FortiManager and FortiGate. 

Regards, 

[ck8882]

Hi @hbac 

I have checked the setting and URL is correct between FortiManager and FortiGate.

You may Please take a look screenshot below. anything else config i did missing? also there is error from forticlient or web access page.

Could you assist it??

Thanks

[Sheikh]

Hello @ck8882 

Install 'SAML tracer' extension in browser and try to open a web page. this might give you some clue about your problem.

You can also collet .HAR file from browser (development tools), while reproducing issue.

regards,

Sheikh

[ck8882]

Would like to confirm the SAML user should create in FMG - IDP or FGT - SP?

Thanks