config system sso-admin

Use this command to manually configure administrator accounts for Single Sign-On (SSO) through the FortiGate Security Fabric.

SSO admin accounts allow FortiADC to recognize and authenticate administrators validated by a root FortiGate acting as a SAML Identity Provider (IdP) within the Security Fabric.

SSO administrator accounts can be created manually or automatically:

• Manual Creation: You can manually create an SSO admin account to pre-define the access profile, VDOM scope, and dashboard settings. Manually created accounts allow you to specify a different access profile or VDOM as needed.

• Automatic Creation: If a matching manual account is not pre-created, FortiADC automatically generates an SSO admin account upon the user’s first login through FortiGate SSO.

Automatically created accounts use the Default SSO Admin Profile. If VDOMs are enabled, these accounts are automatically placed under the root VDOM.

Before you begin:

• The FortiGate Security Fabric connector must be configured and authorized.

• Configuration Sync should be enabled in the Fabric connector to retrieve SAML IdP metadata from the root FortiGate.

Syntax

config system sso-admin

edit <name>

set is-system-admin {no|yes}

set vdom <datasource>

set access-profile <datasource>

set comments <string>

next

end

is-system-admin	Select whether or not to allow the administrator account to have Global access, which is required to access all virtual domains, configure Automation Stitches, and create system backup files. no — This is the default option. The administrator account will only have access to the virtual domain specified in this configuration. Administrators with no Global Admin permission cannot configure Automation Stitches or create system backup files. yes — The administrator account will have access to all virtual domains. With Global Admin access, the administrator can configure Automation Stitches and create system backup files.
vdom	If is-system-admin is no, select the specific VDOMs this administrator is permitted to manage.
access-profile	The access-profile option appears if is-system-admin is no. Select a user-defined or predefined profile to use for the new administrator. The predefined profile named super_admin_prof is a special access profile used by the admin account. However, selecting this access profile will not confer all permissions of the admin account. For example, the new administrator would not be able to reset lost administrator passwords. Note: This option does not appear for the admin administrator account, which by definition always uses the super_admin_prof access profile.
comments	Optionally, enter comments about the administrator account.

Example

config system sso-admin

edit "demo"

set is-system-admin no

set vdom root

set access-profile super_admin_prof

unset comments

next

end