Fortinet black logo

Administration Guide

SAML support for SSL VPN

SAML support for SSL VPN

FortiClient supports SAML authentication for SSL VPN. FortiClient can use a SAML identity provider (IdP) to authenticate an SSL VPN connection. You can configure a FortiGate as a service provider (SP) and a FortiAuthenticator or FortiGate as an IdP. The end user uses FortiClient with the SAML single sign on (SSO) option to establish an SSL VPN tunnel to the FortiGate.

This process is as follows:

  1. The EMS administrator or end user configures an SSL VPN connection with SAML SSO enabled.
  2. FortiClient connects to the FortiGate.
  3. The FortiGate returns a redirect link to the SAML IdP authorization page.
  4. FortiClient displays the IdP authorization page in an embedded browser window.
  5. The end user enters their credentials in the window to log in.
  6. Once the login attempt succeeds, FortiClient establishes a tunnel to the FortiGate.

This example configures a FortiGate as the SP and FortiAuthenticator as the IdP.

To configure the FortiGate as the SP:
  1. Configure the FortiGate SP to be a SAML user. You must configure the IdP remote certificate from FortiAuthenticator on the FortiGate:

    config user saml

    edit "saml-user"

    set cert "Fortinet_Factory"

    set entity-id "http://172.17.61.59:11443/remote/saml/metadata/"

    set single-sign-on-url "https://172.17.61.59:11443/remote/saml/login/"

    set single-logout-url "https://172.17.61.59:11443/remote/saml/logout/"

    set idp-entity-id "http://172.17.61.118:443/saml-idp/101087/metadata/"

    set idp-single-sign-on-url "https://172.17.61.118:443/saml-idp/101087/login/"

    set idp-single-logout-url "https://172.17.61.118:443/saml-idp/101087/logout/"

    set idp-cert "REMOTE_Cert_4"

    next

    end

  2. Add the SAML user to the user group:

    config user group

    edit "saml_grp"

    set member "saml-user"

    next

    end

  3. Set the SAML group in SSL VPN settings:

    config vpn ssl settings

    config authentication-rule

    edit 1

    set groups "saml_grp"

    set portal "full-access"

    next

    next

    end

To configure FortiAuthenticator as the IdP:
  1. In FortiAuthenticator, go to Authentication > SAML IdP > Service Providers.
  2. Click Create New.
  3. Configure as desired, then click OK.

  4. To add a local user, go to Authentication > User Management > Local User, then click Create New. Configure the local user as desired.
  5. To import RADIUS users, go to Authentication > User Management > Remote User > RADIUS Users. Import the desired RADIUS server.
  6. To import LDAP users, go to Authentication > User Management > Remote User > LDAP Users. Import the desired LDAP server.
To configure SAML SSO authentication for FortiClient:
  • To configure SAML SSO authentication for a corporate VPN tunnel in EMS, go to Endpoint Profiles and select the desired profile. On the XML Configuration tab, configure <sso_enabled>1</sso_enabled> for the desired tunnel.
  • To configure SAML SSO authentication for a personal VPN tunnel in FortiClient, on the Remote Access tab, edit or create a new VPN tunnel. Select the Enable Single Sign On (SSO) for VPN Tunnel checkbox.
To connect to a VPN tunnel using SAML authentication:
  1. In FortiClient, on the Remote Access tab, from the VPN Name dropdown list, select the desired VPN tunnel.
  2. Click SAML Login.
  3. FortiClient displays an IdP authorization page in an embedded browser window. Enter your login credentials. Click Login. Once authenticated, FortiClient establishes the SSL VPN tunnel.

SAML support for SSL VPN

FortiClient supports SAML authentication for SSL VPN. FortiClient can use a SAML identity provider (IdP) to authenticate an SSL VPN connection. You can configure a FortiGate as a service provider (SP) and a FortiAuthenticator or FortiGate as an IdP. The end user uses FortiClient with the SAML single sign on (SSO) option to establish an SSL VPN tunnel to the FortiGate.

This process is as follows:

  1. The EMS administrator or end user configures an SSL VPN connection with SAML SSO enabled.
  2. FortiClient connects to the FortiGate.
  3. The FortiGate returns a redirect link to the SAML IdP authorization page.
  4. FortiClient displays the IdP authorization page in an embedded browser window.
  5. The end user enters their credentials in the window to log in.
  6. Once the login attempt succeeds, FortiClient establishes a tunnel to the FortiGate.

This example configures a FortiGate as the SP and FortiAuthenticator as the IdP.

To configure the FortiGate as the SP:
  1. Configure the FortiGate SP to be a SAML user. You must configure the IdP remote certificate from FortiAuthenticator on the FortiGate:

    config user saml

    edit "saml-user"

    set cert "Fortinet_Factory"

    set entity-id "http://172.17.61.59:11443/remote/saml/metadata/"

    set single-sign-on-url "https://172.17.61.59:11443/remote/saml/login/"

    set single-logout-url "https://172.17.61.59:11443/remote/saml/logout/"

    set idp-entity-id "http://172.17.61.118:443/saml-idp/101087/metadata/"

    set idp-single-sign-on-url "https://172.17.61.118:443/saml-idp/101087/login/"

    set idp-single-logout-url "https://172.17.61.118:443/saml-idp/101087/logout/"

    set idp-cert "REMOTE_Cert_4"

    next

    end

  2. Add the SAML user to the user group:

    config user group

    edit "saml_grp"

    set member "saml-user"

    next

    end

  3. Set the SAML group in SSL VPN settings:

    config vpn ssl settings

    config authentication-rule

    edit 1

    set groups "saml_grp"

    set portal "full-access"

    next

    next

    end

To configure FortiAuthenticator as the IdP:
  1. In FortiAuthenticator, go to Authentication > SAML IdP > Service Providers.
  2. Click Create New.
  3. Configure as desired, then click OK.

  4. To add a local user, go to Authentication > User Management > Local User, then click Create New. Configure the local user as desired.
  5. To import RADIUS users, go to Authentication > User Management > Remote User > RADIUS Users. Import the desired RADIUS server.
  6. To import LDAP users, go to Authentication > User Management > Remote User > LDAP Users. Import the desired LDAP server.
To configure SAML SSO authentication for FortiClient:
  • To configure SAML SSO authentication for a corporate VPN tunnel in EMS, go to Endpoint Profiles and select the desired profile. On the XML Configuration tab, configure <sso_enabled>1</sso_enabled> for the desired tunnel.
  • To configure SAML SSO authentication for a personal VPN tunnel in FortiClient, on the Remote Access tab, edit or create a new VPN tunnel. Select the Enable Single Sign On (SSO) for VPN Tunnel checkbox.
To connect to a VPN tunnel using SAML authentication:
  1. In FortiClient, on the Remote Access tab, from the VPN Name dropdown list, select the desired VPN tunnel.
  2. Click SAML Login.
  3. FortiClient displays an IdP authorization page in an embedded browser window. Enter your login credentials. Click Login. Once authenticated, FortiClient establishes the SSL VPN tunnel.