SCIM servers

System for Cross-domain Identity Management (SCIM) is an open-standard protocol that facilitates the exchange of identity data between platforms. See the following RFCs for more information:

• See RFC 7642 for information about definitions, overview, concepts, and requirements.

• See RFC 7643 for information about the core schema.

• See RFC 7644 for information about the protocol.

SCIM is based on a client-server model where the client is usually an identity provider (IdP) that maintains a directory of user identities, and the server is typically a service provider (SP). The client sends user and group information to the server, enabling automatic provisioning of users and groups between the SP and IdP.

With SCIM servers, FortiGate can communicate with an Identity Provider (IdP) using the SCIM 2.0 protocol, which facilitates the automatic provisioning of users and groups on FortiGate. Once users and groups are provisioned on FortiGate, they can be used with SAML to provide user authentication.

The config system global command includes SCIM settings:

config system global
    set scim-http-port <integer>
    set scim-https-port <integer>
    set scim-server-cert <string>
end

scim-http-port <integer>	Specify the port on which the SCIM server will listen for HTTP requests (default = 44558).
scim-https-port <integer>	Specify the port on which the SCIM server will listen for HTTPS requests (default = 44559).
scim-server-cert <string>	Specify the certificate that will be used if the HTTPS protocol is being used to communicate with the SCIM client. The certificate used by FortiGate must be trusted by the SCIM client.

To allow SCIM access in the GUI:

1. Go to Network > Interfaces.

2. Create or edit an interface.

3. In the Administrative Access section, select SCIM.

4. Click OK.

To allow SCIM access in the CLI:

config system interface 
    edit <name>
        append allowaccess scim
    next
end

To configure SCIM client entries in the CLI:

config user scim
    edit <name>
        set status {enable| disable} 
        set base-url <string>
        set client-authentication-method {token | base} 
        set client-secret-token <string>
        set certificate <name>
        set client-identity-check {enable| disable}
    next
end

status {enable| disable}	Enable/disable System for Cross-domain Identity Management (SCIM).
base-url <string>	Server URL to receive SCIM create, read, update, and delete (CRUD) requests. FortiGate will communicate with the SCIM client based on the protocol specified in base-url.
client-authentication-method {token | base}	Specify the TLS client authentication methods (default = bearer token).
certificate <name>	The certificate sent by the SCIM client during the TLS handshake. Applies when HTTPS is used for communication. FortiGate must have the corresponding Certificate Authority (CA) certificate installed.
client-identity-check {enable| disable}	Enable/disable client identity check (default = disabled). When enabled, FortiOS will check the Subject Alternative Name (SAN) field of the SCIM client certificate, which must contain a correct FQDN or URL.

To add SCIM client to SAML server configuration:

config user saml
    edit <name>
        set scim-client <name>
    next
end

Example

In this example, FortiGate is configured as the SCIM server (SP), and FortiAuthenticator is configured as the SCIM client (IdP). Two groups are configured on FortiAuthenticator: IT and Pochiya clan. The groups contain the following users:

• The IT group contains three users: admin, sk, and sy.

• The Pochiya clan group contains two users: naynay and kiki.

Upon successful configuration, users and groups are provisioned on FortiGate. This setup can leverage SAML to provide access to authenticated users.

To configure FortiGate as an SCIM server:

1. Allow SCIM access on an interface:

   config system interface 
       edit port2
           append allowaccess scim
       next
   end

2. Specify the SCIM server certificate:

   config system global
       set scim-server-cert ‘SCIM-Demo-CA-SSL’
   end

3. Configure SCIM client entries:

   config user scim
       edit "SCIM-server-to-FAC"
           set status enable 
           set base-url ‘https://10.88.0.254/scim/v2’
           set client-authentication-method base
           set client-secret-token ‘**********’
           set certificate ‘REMOTE_Cert_2’
           set client-identity-check enable
       next
   end

To configure FortiAuthenticator as an SCIM client:

1. On FortiAuthenticator, use your admin account to log in.

2. Click Authentication > SCIM > Service Provider.

3. Click Create New, and configure the following settings:

   Name	Test-SCIM
   SCIM endpoint	https://10.88.0.254:44559/scim/v2
   Access token	**********

4. Configure the remaining settings as required, and click Save.

5. Once the setting is saved, double-click the newly created entry to open the settings pane, and click Sync to automatically add existing users to the SCIM server.

See Service providers for more information

The SCIM endpoint and access token must match the base-url and client-secret-token respectively, as configured on the FortiGate. Furthermore, an initial synchronization is necessary to commence provisioning for the first time. However, when alterations to identities occur in the IdP, including creation, updating, and deletion, these changes are automatically synchronized with SP in accordance with the SCIM protocol.

To verify whether users and groups are provisioned on FortiGate:

# diagnose test scim list-clients
There are 1 clients in vdom. 
id:1 name:SCIM-server-to-FAC

# diagnose test scim list-groups SCIM-server-to-FAC

IT
pochiya clan
total:2

# diagnose test scim list-users SCIM-server-to-FAC

admin
kiki
naynay
sk
sy

To add an SCIM group to a SAML server configuration:

config user saml
    edit "SCIM-SAML"
        set scim-client "SCIM-server-to-FAC" 
    next
end

To modify the SAML user group used in the firewall policy:

The configuration in this topic incorporates all the SCIM groups configured on FortiAuthenticator and enables all users to authenticate. However, if you want to limit authentication to users who belong to specific groups, such as the IT group, the following additional configuration is necessary:

config user group
    edit saml-scim
        set member "SCIM-SAML"
        config match
            edit 1
                set server-name "SCIM-SAML"
                set group-name "IT"
            next
        end
    next
end

For brevity, only the commands relevant to this enhancement are included. See SAML for more information about configuring SP and IdP.