Fortinet black logo

CLI Reference

saml

saml

Use this command to configure global settings for SAML authentication.

Syntax

config system saml

set acs-url

set cert <certificate>

set default-profile <string>

set entity-id <string>

set forticloud-sso {enable | disable}

set idp-cert <string>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set login-auto-redirect {enable | disable}

set role {FAB-SP | IDP | SP}

set server-address <string>

set sls-url

set status {enable | disable}

set user-auto-create {enable | disable}

config service-providers

edit <name>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set prefix <string>

set sp-adom <string>

set sp-cert <string>

set sp-entity-id <string>

set sp-profile <string>

set sp-single-logout-url <string>

set sp-single-sign-on-url <string>

next

end

config fabric-idp

edit <device-id>

set idp-cert <string>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set idp-status {enable | disable}

next

end

end

Variable

Description

acs-url

cert <certificate> The certificate name.

default-profile <string>

The default profile (default = Restricted_User).

entity-id <string> The entity ID.

forticloud-sso {enable | disable}

Enable/disable FortiCloud SSO (default = disable).

idp-cert <string> The IDP certificate name.
idp-entity-id <string> The IDP entity ID.
idp-single-logout-url <string> The IDP single logout URL.
idp-single-sign-on-url <string> The IDP single sign-on URL.

login-auto-redirect {enable | disable}

Enable/disable automatic redirect to the IDP login page (default = disable).

role {FAB-SP | IDP | SP}

The SAML role:

  • FAB-SP: Fabric service provider
  • IDP: Identity provider
  • SP: Service provider (default)

server-address <string>

The server address.

sls-url

status {enable | disable} Enable/disable SAML authentication (default = disable).

user-auto-create {enable | disable}

Enable/disable automatic user creation (default = disable).

Variables for config service-providers subcommand:

This command is only available when role is IDP.

<name> Service provide name.
idp-entity-id <string> The IDP entity ID.
idp-single-logout-url <string> The IDP single logout URL.
idp-single-sign-on-url <string> The IDP single sign-on URL.
prefix <string> The prefix. Can contain only letters and numbers.

sp-adom <string>

The SP ADOM name.

sp-cert <string> The SP certificate name.
sp-entity-id <string> The SP entity ID.

sp-profile <string>

The SP profile name.

sp-single-logout-url <string> The SP single sign-on URL.
sp-single-sign-on-url <string> The SP single logout URL.

Variables for config fabric-idp subcommand:

This command is only available when role is FAB-SP.

<device-id> Device ID.
idp-cert <string> The IDP certificate name.
idp-entity-id <string> The IDP entity ID.
idp-single-logout-url <string> The IDP single logout URL.
idp-single-sign-on-url <string> The IDP single sign-on URL.

idp-status {enable | disable}

Enable/disable SAML authentication (default = disable).

To view the service provider IdP information, use the following commands:

config system saml

config service-providers

edit <name>

get

Output:

name : name

prefix : y9jr06vq0k

sp-cert : (null)

sp-entity-id : http://https://172.27.2.225//metadata/

sp-single-sign-on-url: https://https://172.27.2.225//saml/?acs

sp-single-logout-url: https://https://172.27.2.225//saml/?sls

sp-adom: (null)

sp-profile: (null)

idp-entity-id : http://172.27.2.225/saml-idp/y9jr06vq0k/metadata/

idp-single-sign-on-url: https://172.27.2.225/saml-idp/y9jr06vq0k/login/

idp-single-logout-url: https://172.27.2.225/saml-idp/y9jr06vq0k/logout/

saml

Use this command to configure global settings for SAML authentication.

Syntax

config system saml

set acs-url

set cert <certificate>

set default-profile <string>

set entity-id <string>

set forticloud-sso {enable | disable}

set idp-cert <string>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set login-auto-redirect {enable | disable}

set role {FAB-SP | IDP | SP}

set server-address <string>

set sls-url

set status {enable | disable}

set user-auto-create {enable | disable}

config service-providers

edit <name>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set prefix <string>

set sp-adom <string>

set sp-cert <string>

set sp-entity-id <string>

set sp-profile <string>

set sp-single-logout-url <string>

set sp-single-sign-on-url <string>

next

end

config fabric-idp

edit <device-id>

set idp-cert <string>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set idp-status {enable | disable}

next

end

end

Variable

Description

acs-url

cert <certificate> The certificate name.

default-profile <string>

The default profile (default = Restricted_User).

entity-id <string> The entity ID.

forticloud-sso {enable | disable}

Enable/disable FortiCloud SSO (default = disable).

idp-cert <string> The IDP certificate name.
idp-entity-id <string> The IDP entity ID.
idp-single-logout-url <string> The IDP single logout URL.
idp-single-sign-on-url <string> The IDP single sign-on URL.

login-auto-redirect {enable | disable}

Enable/disable automatic redirect to the IDP login page (default = disable).

role {FAB-SP | IDP | SP}

The SAML role:

  • FAB-SP: Fabric service provider
  • IDP: Identity provider
  • SP: Service provider (default)

server-address <string>

The server address.

sls-url

status {enable | disable} Enable/disable SAML authentication (default = disable).

user-auto-create {enable | disable}

Enable/disable automatic user creation (default = disable).

Variables for config service-providers subcommand:

This command is only available when role is IDP.

<name> Service provide name.
idp-entity-id <string> The IDP entity ID.
idp-single-logout-url <string> The IDP single logout URL.
idp-single-sign-on-url <string> The IDP single sign-on URL.
prefix <string> The prefix. Can contain only letters and numbers.

sp-adom <string>

The SP ADOM name.

sp-cert <string> The SP certificate name.
sp-entity-id <string> The SP entity ID.

sp-profile <string>

The SP profile name.

sp-single-logout-url <string> The SP single sign-on URL.
sp-single-sign-on-url <string> The SP single logout URL.

Variables for config fabric-idp subcommand:

This command is only available when role is FAB-SP.

<device-id> Device ID.
idp-cert <string> The IDP certificate name.
idp-entity-id <string> The IDP entity ID.
idp-single-logout-url <string> The IDP single logout URL.
idp-single-sign-on-url <string> The IDP single sign-on URL.

idp-status {enable | disable}

Enable/disable SAML authentication (default = disable).

To view the service provider IdP information, use the following commands:

config system saml

config service-providers

edit <name>

get

Output:

name : name

prefix : y9jr06vq0k

sp-cert : (null)

sp-entity-id : http://https://172.27.2.225//metadata/

sp-single-sign-on-url: https://https://172.27.2.225//saml/?acs

sp-single-logout-url: https://https://172.27.2.225//saml/?sls

sp-adom: (null)

sp-profile: (null)

idp-entity-id : http://172.27.2.225/saml-idp/y9jr06vq0k/metadata/

idp-single-sign-on-url: https://172.27.2.225/saml-idp/y9jr06vq0k/login/

idp-single-logout-url: https://172.27.2.225/saml-idp/y9jr06vq0k/logout/