What's new

The following sections describe new features, enhancements, and changes in FortiProxy 7.6.3:

• Traffic shaping based on HTTP response

• OIDC enhancements

• ZTNA web portal enhancements

• Support for Securosys Primus HSM

• Support SHA-256 for digest authentication method

• Increase proxy-address configuration limit

• CLI changes

Traffic shaping based on HTTP response

FortiProxy 7.6.3 introduces the new response shaping policy, which is a specialized type of traffic shaping policy that works on the top of a traffic shaping policy to further match the traffic based on certain HTTP response header fields. When Http Response Match is enabled in a traffic shaping policy, any traffic that matches the traffic shaping policy is further evaluated against the list of response shaping policies. If a match is found, the traffic will be mapped to the traffic shaper or assigned to the class defined in the response shaping policy instead of the ones defined in the original matching traffic shaping policy.

See Traffic shaping based on HTTP response in the Administration Guide for an end-to-end configuration example.

OIDC enhancements

FortiProxy 7.6.3 includes the following enhancements to OIDC:

• Support for multiple OIDC identity providers (IdPs) in one authentication scheme

  When multiple IdPs are configured, users can select which IdP to use in the OIDC landing page, allowing for flexible authentication across different user groups. This feature is useful in the following scenarios:

  • The organization manages multiple IdPs for different user sets (e.g., Azure AD for employees, Google Identity for contractors).

  • A transition between identity providers is required (e.g., migrating from Okta to Azure AD).

  • Users need to choose their preferred IdP for authentication.

• Support private and public key pairs during authentication communication between FortiProxy and the cloud IdP

  FortiProxy generates a private key, uploads the public key to the IdP, and authenticate with JWT using the private key. This is recommended for high-security environments where secret-based authentication is less desirable.

  To do so, use the following new CLI options under config user oidc:

  config user oidc

  edit <name>

  set auth-type private-key

  set auth-method private_key_jwt

  set private-key {string}

  next

  end

• Authentication with FortiAuthenticator groups—You can now configure the OIDC server to be FortiAuthenticator using the group attribute name.

• Disabling HTTPS certificate verification—You can now configure FortiProxy to disable HTTPS certificate verification during OIDC authentication using the new set verify-cert subcommand under config user oidc.

ZTNA web portal enhancements

FortiProxy 7.6.3 includes the following enhancements to ZTNA agentless web-based application access:

• Dynamic bookmarks using SAML attributes—Administrators can define dynamic bookmarks to generate personalized application shortcuts using a SAML attribute within the user's SAML account so that bookmarks are auto-populated with the values defined in that attribute instead of static pre-defined IP or hostnames.

• New login method using OIDC—You can now log into the ZTNA web portal using OIDC.

Support for Securosys Primus HSM

FortiProxy 7.6.3 adds support for Securosys Primus HSM.

• Under config system nethsm, you can now configure the HSM vendor to be Securosys Primus and then configure the Primus-related settings:

  config system nethsm

  set status enable

  set vendor primus

  set primus-cfg <primus.cfg file content>

  set secret-content <Encrypted Config>

  config partitions

  edit "PRIMUSDEV270"

  set slot-id 1

  set pkcs11-pin <Encrypted password>

  next

  end

• When configuring local keys and certificates using the config vpn certificate local command, you can now configure the HSM vendor to be Securosys Primus HSM and configure the HSM key type.

• You can perform operations on Primus HSM using the new execute nethsm primus command.

Support SHA-256 for digest authentication method

FortiProxy 7.6.3 adds support for SHA-256, which is mandatory in RFC 7616.

To configure the digest algorithm to be SHA-256:

config authentication scheme

edit "digest-scheme"

set method digest

set fsso-guest disable

set digest-algo md5 sha-256

next

end

Increase proxy-address configuration limit

FortiProxy 7.6.3 includes the following changes to the proxy-address configuration limit for VM04 and VM08:

Proxy address object	New configuration limit for 7.6.3
Proxy Address Object	80K
Proxy Address Group	4096
Proxy Address Group Member	30K

CLI changes

FortiProxy 7.6.3 includes the following CLI changes:

• config system global—Use the new set tcp-random-source-port subcommand to enable or disable (default) TCP IPv4 random source port.

• config webfilter urlfilter—Use the new set include-subdomains subcommand to enable (default) or disable (default) matching subdomains.

• config vpn certificate local—This command adds support for Securosys Primus HSM with the following changes:

  • Use the new hsm-vendor subcommand to configure the HSM vendor.

    safenet	Safenet HSM.
    primus	Securosys Primus HSM.

  • Use the new hsm-keytype subcommand to configure the HSM key type.

    rsa	RSA key type.
    ec	EC key type.

  • The nethsm-slot command is renamed hsm-slot.

  • The execute nethsm command is renamed execute nethsm safenet.

    Use the new execute nethsm primus command to perform operations on Primus HSM with the following options:

    # execute nethsm primus

    clear-pkcs-provider-log Clear logs from /tmp/pkcs11.log, generated by pkcs11.so, the OpenSSL provider.

    clear-primus-log Clear logs from /tmp/primus.log, generated by libprimusP11.so.

    delete-object Delete Hardware Security Module object(s).

    dump-pkcs-provider-log Dump logs from /tmp/pkcs11.log, generated by pkcs11.so, the OpenSSL provider.

    dump-primus-log Dump logs from /tmp/primus.log, generated by libprimusP11.so.

    inspect-primus-library-info Display information about the integrated libprimusP11.so library.

    list-objects List Hardware Security Module objects.

    upload-primus-cfg Upload nethsm primus.cfg file.

    upload-primus-cfg-raw Upload nethsm primus.cfg file.

  • config system nethsm—The set vendor parameter includes the new primus option to configure the HSM vendor to be Securosys Primus. You can then configure the Primus-related settings:

    config system nethsm

    set status enable

    set vendor primus

    set primus-cfg <primus.cfg file content>

    set secret-content <Encrypted Config>

    config partitions

    edit "PRIMUSDEV270"

    set slot-id 1

    set pkcs11-pin <Encrypted password>

    next

    end

• config vpn certificate hsm-local—The set gch-cryptokey-algorithm subcommand includes the following new options:

  Option	Description
  rsa-sign-pss-3072-sha256	3072 bit RSA - PSS padding - SHA256 Digest.
  rsa-sign-pss-4096-sha256	4096 bit RSA - PSS padding - SHA256 Digest.
  rsa-sign-pss-4096-sha512	4096 bit RSA - PSS padding - SHA256 Digest.
  ec-sign-p256-sha256	Elliptic Curve P-256 - SHA256 Digest.

• config icap remote-server and config user ldap—The set validate-server-certificate subcommand is removed.

• diagnose wad worker oidc refresh-server—Use this new command to manually refresh OIDC discovery servers.

  The automatic refresh rate is once per minute for servers in error state and once per hour for servers in ready state.