| Solution |
In FortiAuthenticator, follow the steps below:
- Enable the SAML Identity Provider portal.
- Set either an IP or FQDN (preferred) server address and a prefix.
- Select the correct realm. In this case, select LDAP.
- Create a remote group. Add users/admins and a filter for the group.
-
Download the IDP server certificate highlighted above.
-
Create an SP:
Add the following claim, filling in details as necessary:
SAML attribute: 'username'.
User attribute: Remote LDAP Server: samAccountName (or Username attribute: configured in Auth, Remote Auth Servers, LDAP).
Follow the steps below in FortiGate:
- Enable SSO Admin login.
-
For the IdP address, provide the IP or FQDN (preferred) and a prefix. The details should be the same as configured in step 2.
-
Upload the certificate downloaded in step 4.
Alternatively, run the following in the CLI (the details provided are examples):
config system saml
set status enable
set default-profile "super_admin"
set idp-entity-id "http://fortiauth.local/saml-idp/fgtadm/metadata/"
set idp-single-sign-on-url "https://fortiauth.local/saml-idp/fgtadm/login/"
set idp-single-logout-url "https://fortiauth.local/saml-idp/fgtadm/logout/"
set idp-cert "fortiauth.local_SAN"
set server-address "10.191.19.149:4443"
end
-
Logout from FortiGate, refresh, select the SSO option, and auth with LDAP credentials on FortiAuthenticator (IDP):
- Login to the firewall as an SSO admin. If the steps are completed, this will succeed.
- Right now, there are no options to configure SAML SSO-admin authentication per VDOM based. As a workaround, these steps could be performed (if it fits):
1. If possible, set FortiGate's SSO URL to an FQDN and use DNS to point to different VDOM IPs to make some users hit the FortiGate with different IPs using the same FQDN.
2. Add VDOM to admin account's VDOM list, (not ideal if permission is a problem).
3. Change the SSO URL to the VDOM's IP that is needed. Refer to this article on how to resolve two different IPs per FQDN.
If there is a requirement to bind admin users to the SAML accounts and provide access to the specific VDOM, then follow Technical Tip: FortiGate - Admin login with remote Radius and vdom access profile:
- FortiAuthenticator acting as a RADIUS Server.
- FortiGate is configured as a RADIUS client, with remote admin wildcard group, and VDOM override enabled.
Troubleshooting:
Useful debug commands - httpsd (general admin GUI debugging), samld (SAML-specific debugs).
Usage:
diagnose debug application httpsd -1
diagnose debug application samld -1
diagnose debug console timestamp enable
diagnose debug enable
|
