Enabling SAML authentication in a Security Fabric

When FortiGate is configured as a SAML SSO IdP in a Security Fabric, FortiAnalyzer can register itself to FortiGate as an SAML service provider, allowing for simplified configuration of SAML authentication.

When FortiAnalyzer is configured as a Fabric SP, a default SSO administrator is automatically created for each Security Fabric. When a user logs in through Fabric SSO, the Fabric IdP provides the user's profile name. If FortiAnalyzer has a profile with a matching name, the profile is assigned to the user. Otherwise, the profile of the SSO administrator is assigned to the user by default.

Before configuring FortiAnalyzer as a Fabric SP, FortiAnalyzer Logging and Security Fabric Connection must be configured on the root FortiGate.

When ADOMs are enabled, SSO users can only access the ADOM that includes the root FortiGate.

To configure FortiAnalyzer as a Fabric SP:

1. Before configuring FortiAnalyzer as a Fabric SP, configure the following on the root FortiGate:

   1. To enable FortiAnalyzer Logging on the root FortiGate, see Logging to FortiAnalyzer in the FortiGate / FortiOS Administration Guide.

   2. To configure a Security Fabric Connection on the root FortiGate, see Configuring the root FortiGate and downstream FortiGates in the FortiGate / FortiOS Administration Guide.

   3. To enable SAML Single Sign-on on the root FortiGate, see Configuring the root FortiGate as the IdP in the FortiGate / FortiOS Administration Guide.

2. In the FortiAnalyzer GUI, enable the Fabric SP Single Sign-On Mode.

   1. Go to System Settings > SAML SSO.

   2. Select Fabric SP as the Single Sign-On Mode.

   3. Enter the address of the FortiAnalyzer SP.

   4. Select a Default Admin Profile.

   5. Click Apply.

      The FortiAnalyzer will automatically detect the IdP FortiGate and register itself as a SAML SP. This process may take up to ten minutes. Once completed, IdP information is displayed in the Fabric IdPs table on FortiAnalyzer, and SP information can be viewed in FortiOS.
      

3. In the FortiAnalyzer CLI, enable user-auto-create for the Fabric SP using the following command:

   config system saml

   set user-auto-create enable

   end

   The user-auto-create setting must be enabled to automatically create an SSO admin which will be used for the security fabric. This admin can be found in the FortiAnalyzer GUI under System Settings > Administrators with the name "CSF_SSO_FG<serial number>".

4. When logging into FortiAnalyzer, the Fabric SSO user can click Login via Fabric Single Sign-On.
   

   The user can then select which Fabric IdP to use. In this example, the user selects csf-v64b.
   

   The user is then logged into FortiAnalyzer with access according to the selected Default Admin Profile.