saml
Use this command to configure global settings for SAML authentication.
Syntax
config system saml
set acs-url
set cert <certificate>
set default-profile <string>
set entity-id <string>
set forticloud-sso {enable | disable}
set idp-cert <string>
set idp-entity-id <string>
set idp-single-logout-url <string>
set idp-single-sign-on-url <string>
set login-auto-redirect {enable | disable}
set role {FAB-SP | IDP | SP}
set server-address <string>
set sls-url
set status {enable | disable}
set user-auto-create {enable | disable}
config service-providers
edit <name>
set idp-entity-id <string>
set idp-single-logout-url <string>
set idp-single-sign-on-url <string>
set prefix <string>
set sp-adom <string>
set sp-cert <string>
set sp-entity-id <string>
set sp-profile <string>
set sp-single-logout-url <string>
set sp-single-sign-on-url <string>
next
end
config fabric-idp
edit <device-id>
set idp-cert <string>
set idp-entity-id <string>
set idp-single-logout-url <string>
set idp-single-sign-on-url <string>
set idp-status {enable | disable}
next
end
end
Variable |
Description |
---|---|
acs-url |
|
cert <certificate> | The certificate name. |
default-profile <string> |
The default profile (default = Restricted_User). |
entity-id <string> | The entity ID. |
forticloud-sso {enable | disable} |
Enable/disable FortiCloud SSO (default = disable). |
idp-cert <string> | The IDP certificate name. |
idp-entity-id <string> | The IDP entity ID. |
idp-single-logout-url <string> | The IDP single logout URL. |
idp-single-sign-on-url <string> | The IDP single sign-on URL. |
login-auto-redirect {enable | disable} |
Enable/disable automatic redirect to the IDP login page (default = disable). |
role {FAB-SP | IDP | SP} |
The SAML role:
|
server-address <string> |
The server address. |
sls-url |
|
status {enable | disable} | Enable/disable SAML authentication (default = disable). |
user-auto-create {enable | disable} |
Enable/disable automatic user creation (default = disable). |
Variables for This command is only available when |
|
<name> | Service provide name. |
idp-entity-id <string> | The IDP entity ID. |
idp-single-logout-url <string> | The IDP single logout URL. |
idp-single-sign-on-url <string> | The IDP single sign-on URL. |
prefix <string> | The prefix. Can contain only letters and numbers. |
sp-adom <string> |
The SP ADOM name. |
sp-cert <string> | The SP certificate name. |
sp-entity-id <string> | The SP entity ID. |
sp-profile <string> |
The SP profile name. |
sp-single-logout-url <string> | The SP single sign-on URL. |
sp-single-sign-on-url <string> | The SP single logout URL. |
Variables for This command is only available when |
|
<device-id> | Device ID. |
idp-cert <string> | The IDP certificate name. |
idp-entity-id <string> | The IDP entity ID. |
idp-single-logout-url <string> | The IDP single logout URL. |
idp-single-sign-on-url <string> | The IDP single sign-on URL. |
idp-status {enable | disable} |
Enable/disable SAML authentication (default = disable). |
To view the service provider IdP information, use the following commands:
config system saml
config service-providers
edit <name>
get
Output:
name : name
prefix : y9jr06vq0k
sp-cert : (null)
sp-entity-id : http://https://172.27.2.225//metadata/
sp-single-sign-on-url: https://https://172.27.2.225//saml/?acs
sp-single-logout-url: https://https://172.27.2.225//saml/?sls
sp-adom: (null)
sp-profile: (null)
idp-entity-id : http://172.27.2.225/saml-idp/y9jr06vq0k/metadata/
idp-single-sign-on-url: https://172.27.2.225/saml-idp/y9jr06vq0k/login/
idp-single-logout-url: https://172.27.2.225/saml-idp/y9jr06vq0k/logout/