Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
pmit
New Contributor III

SSLVPN SAML with Google IDP

SSLVPN SAML is working in 6.4 with Google IDP

 

config user saml edit "Google" set entity-id "https://gateway.xxxxx.com/remote/saml/metadata" set single-sign-on-url "https://gateway.xxxxx.com/remote/saml/login" set single-logout-url "https://gateway.xxxxx.com/remote/logout" set idp-entity-id "https://accounts.google.com/o/saml2?idpid=C011xxxxx" set idp-single-sign-on-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-single-logout-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-cert "REMOTE_Cert_1" set user-name "Email" set group-name "Memberof" next end

 

Make sure you have local users with full email address for user name in Fortigate.

 

Google setup is simple.

 

ACS

https://gateway.XXXXX.com/remote/saml/login

Entity ID

https://gateway.XXXXX.com/remote/saml/metadata

Start URL

https://gateway.XXXXX.com/remote/saml/login

 

NameID - Basic Info - Primary Email

Name IF Format - Email

 

 

3 REPLIES 3
pmit
New Contributor III

Seems to be no easy way to separate groups though. Fortigate treats every SAML user as the same group, so you cannot assign different SSL portals or policy! At least this is what I've found so far. 

pmit
New Contributor III

It works! So you must use group matching.

 

The beautiful part is you can create a custom schema in Google just for Fortinet portals and pull that through the SAML attribute. 

Make sure your config user saml is the same as your attribute in Google so..

 

config user saml

edit "Google" set entity-id "https://gateway.xxxxx.com/remote/saml/metadata" set single-sign-on-url "https://gateway.xxxxx.com/remote/saml/login" set single-logout-url "https://gateway.xxxxx.com/remote/logout" set idp-entity-id "https://accounts.google.com/o/saml2?idpid=C011xxxxx" set idp-single-sign-on-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-single-logout-url "https://accounts.google.com/o/saml2/idp?idpid=C011xxxxx" set idp-cert "REMOTE_Cert_1" set user-name "Email" set group-name "Memberof" next

 

 

In Google

Attribute Mapping

Email - Basic Information - Primary Email

Memberof - CustomSchema - your_custom_schema_field

 

In Fortigate

 

config user group edit "studnetSAML" set group-type firewall set authtimeout 0 set auth-concurrent-override disable set http-digest-realm '' set member "Google" config match edit 1 set server-name "Google" set group-name "your_custom_schema_field" next end

 

You must ALSO create a firewall group for each individual group mapped to a portal.

 

 

ted_barker

!! thanks for sharing
Labels
Top Kudoed Authors