FortiGate filtering
If you are providing FSSO to only certain groups on a remote LDAP server, you can filter the polling information so that it includes only those groups, or organizational units (OU).
To view a list of the FortiGate group filters, go to Fortinet SSO Methods > SSO > FortiGate Filtering.
To create a new filter:
- From the FortiGate filters select Create New.
- Enter the following information:
Name Enter a name in the Name field to identify the filter. FortiGate name/IP Enter the FortiGate unit’s FQDN or IP address. Description Optionally, enter a description of the filter. IP Filtering Select to enable IP filtering for this service and from the dropdown, select IP filtering rules.
Note: If you have not yet configured IP filtering rules, you can create them in Fortinet SSO Methods > SSO > IP Filtering Rules (see IP filtering rules for more information).
Domain Grouping Filtering Select to enable forwarding FSSO information for users from only the selected domain groupings.
See Domain groupings for more information.
Fortinet Single Sign-On (FSSO) Select to enable forwarding FSSO information for users from only the specific subset of users, groups, or containers.
Select from the following options:
Add Filtering Object: Enter the name and select an object type from the following:
Group: Specifies the DN of a group. All users who are members of that group must be included in SSO.
Group container: Specifies the DN of an LDAP container, e.g. OU. All users who are members of a group under that container or one of its sub-containers must be included in SSO.
User: Specifies the DN of a user. This user must be included in SSO.
User container: Specifies the DN of an LDAP container, e.g. OU. All users who are under that container or one of its sub-containers must be included in SSO.
User and group container: Specifies the DN of an LDAP container, e.g. OU. It is the union of the user and the group containers.
Import from LDAP server:
In the Import Remote LDAP Objects window:
- Enable Exclude users to exclude users from the FortiGate filter.
- From the Remote LDAP server dropdown, select an LDAP server.
- Click OK.
Select from SSO users/groups:
In Select SSO Objects:
- From SSO Groups, select groups from the Available Groups list and move them to the Chosen Groups list.
- From SSO Users, select groups and move them to the Chosen Users list.
- Click Save.
Import from Azure AD:
In Select Azure Groups:
- From the OAuth server dropdown, select an OAuth server.
- From Azure Groups, select groups from the Available Azure Groups list and move them to the Chosen Azure Groups list.
- Click Save.
This allows you to import native Azure AD groups.
- Select Save to create the new FortiGate group filter.
The Create New FortiGate Filter window opens.