system saml
Use this command to configure FortiMail to act as a SAML SSO service provider (SP).
In Security Assertion Markup Language (SAML) SSO, you must configure both of these to connect and authenticate with each other:
- FortiMail, which is the service provider (SP)
- FortiAuthenticator or other remote authentication server, which is the identity provider (IdP). See profile sso.
When you enable SSO, FortiMail automatically generates its SP metadata XML, entity ID, and ACS URL. (To download them, use the GUI.)
Syntax
config system saml
set dynamic-ip-status {enable | disable}
set dynamic-ip {<client_ipv4/mask>,...}
set sp-entity-id "<entity-id_str>"
set second-sp-status {enable | disable}
end
|
Variable |
Description |
Default |
||
|
Enable or disable the feature. |
disable |
|||
|
Enter the IdP's client IP addresses or subnet in CIDR or dotted decimal format. Separate multiple IP addresses or subnets with a comma. Spaces are not allowed. If no IP range is specified, then any IP address is allowed. Tip: For better security, only allow IdP communications from known IP addresses. |
|
|||
|
Enable if the IdP uses dynamic client IP addresses, even within the same SAML session. (This can be useful, for example, if the IdP is deployed behind a load balancer.) Also configure dynamic-ip {<client_ipv4/mask>,...}. |
disable |
|||
|
Enter the globally unique entity identifier for FortiMail admin GUI when it connects to the IdP, such as: https://FortiMail.example.com/sp
|
|
|||
|
Enable the second service provider. Starting from v7.6.4, you can use two separate service provider (SP) entities for admin access (https://fortimail-hostname-or-ip/admin) and webmail access (https://fortimail-hostname-or-ip) respectively. |
|
|||
|
Enter the globally unique entity identifier for FortiMail webmail when it connects to the IdP, such as: https://FortiMail.example.com/sp2 |
|
