Remote authentication: SSO

For single sign-on (SSO), FortiPortal supports both service provider (SP) initiated and identity provider (IDP) initiated SAML authentication.

FortiPortal requires that all SAML responses and assertions are signed.

Set custom attributes to identify what fields in the SAML assertion will hold the needed values:

FortiPortal field	Example attribute name	Example attribute value	Description
Role Attribute	FPC_Role	`user.jobtitle`	Used to map the IDP server roles to FortiPortal profiles. Required.
Site Attribute	FPC_Site	`user.officelocation`	Used to restrict an account to a specific site or location. Optional.
Tenant Identification Attribute	FPC_Tenant	`user.companyname`	Defines the field in the SAML assertion that holds the user's domain name, which is then used to map to an organization or administration domain. Optional. See Tenant identification and domains for more information.
Email Attribute	FPC_Email	`user.mail`	Defines the field in the SAML assertion that holds the user's email address, which is then used to map to a organization or administration domain if Tenant Identification Attribute is not set and the username is not in email format. Optional.

In the Authentication Access field, select Remote.
In the Remote Server field, select SSO.
Enter the SSO IDP Entity URL. The name of this field on your provider may vary. For example, in Azure AD, this value is found in the Identifier field.
Enter the IDP Sign On Service Enpoint URL. For example, in Azure AD, this value is found in the Login URL field.
Enter the IDP Sign on Service Redirect Endpoint URL. This value is usually the same as the IDP Sign On Service Endpoint URL.
Enter the SSO Application ID as set in your IDP configuration.
Enter the SSO Audience URL value from the sign on URL as set in your IDP configuration. This is usually https://<portal>/fpc/saml/SSO.
Enter the Role Attribute as set in your IDP configuration.
Enter the Tenant Identification Attribute as set in your IDP configuration. If set, this value is used to match the user with an organization. For more information, see Tenant identification and domains.
Enter the IDP Logout Service Endpoint. In Azure AD, this value is found in the Logout URL field.
Enter the SSO Certificate from your IDP server. Strip out any carriage returns and the BEGIN CERTIFICATE and END CERTIFICATE sections.
Enter the Site Attribute as set in your IDP configuration.
Optionally, enter the Email Attribute.
Select the domains to be used for administration access. For more information about how domain matching works, see Tenant identification and domains.
Click Save.

To use two-factor authentication, select the Remote authentication access and SSO and configure two-factor authentication on the SAML IDP server.

When troubleshooting single sign-on, use the following URL for the spuser account to authenticate locally, bypassing remote authentication:

https://<Portal>/fpc/app/admin

For single sign-on (SSO), FortiPortal supports both service provider (SP) initiated and identity provider (IDP) initiated SAML authentication.

FortiPortal requires that all SAML responses and assertions are signed.

Set custom attributes to identify what fields in the SAML assertion will hold the needed values:

FortiPortal field	Example attribute name	Example attribute value	Description
Role Attribute	FPC_Role	`user.jobtitle`	Used to map the IDP server roles to FortiPortal profiles. Required.
Site Attribute	FPC_Site	`user.officelocation`	Used to restrict an account to a specific site or location. Optional.
Tenant Identification Attribute	FPC_Tenant	`user.companyname`	Defines the field in the SAML assertion that holds the user's domain name, which is then used to map to an organization or administration domain. Optional. See Tenant identification and domains for more information.
Email Attribute	FPC_Email	`user.mail`	Defines the field in the SAML assertion that holds the user's email address, which is then used to map to a organization or administration domain if Tenant Identification Attribute is not set and the username is not in email format. Optional.

In the Authentication Access field, select Remote.
In the Remote Server field, select SSO.
Enter the SSO IDP Entity URL. The name of this field on your provider may vary. For example, in Azure AD, this value is found in the Identifier field.
Enter the IDP Sign On Service Enpoint URL. For example, in Azure AD, this value is found in the Login URL field.
Enter the IDP Sign on Service Redirect Endpoint URL. This value is usually the same as the IDP Sign On Service Endpoint URL.
Enter the SSO Application ID as set in your IDP configuration.
Enter the SSO Audience URL value from the sign on URL as set in your IDP configuration. This is usually https://<portal>/fpc/saml/SSO.
Enter the Role Attribute as set in your IDP configuration.
Enter the Tenant Identification Attribute as set in your IDP configuration. If set, this value is used to match the user with an organization. For more information, see Tenant identification and domains.
Enter the IDP Logout Service Endpoint. In Azure AD, this value is found in the Logout URL field.
Enter the SSO Certificate from your IDP server. Strip out any carriage returns and the BEGIN CERTIFICATE and END CERTIFICATE sections.
Enter the Site Attribute as set in your IDP configuration.
Optionally, enter the Email Attribute.
Select the domains to be used for administration access. For more information about how domain matching works, see Tenant identification and domains.
Click Save.

To use two-factor authentication, select the Remote authentication access and SSO and configure two-factor authentication on the SAML IDP server.

When troubleshooting single sign-on, use the following URL for the spuser account to authenticate locally, bypassing remote authentication:

https://<Portal>/fpc/app/admin