saml

Use this command to configure global settings for SAML authentication.

Syntax

config system saml

set acs-url

set auth-request-signed {enable | disable}

set cert <certificate>

set default-profile <string>

set entity-id <string>

set forticloud-sso {enable | disable}

set idp-cert <string>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set login-auto-redirect {enable | disable}

set role {FAB-SP | IDP | SP}

set server-address <string>

set sls-url

set status {enable | disable}

set user-auto-create {enable | disable}

set want-assertions-signed {enable | disable}

config service-providers

edit <name>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set prefix <string>

set sp-adom <string>

set sp-cert <string>

set sp-entity-id <string>

set sp-profile <string>

set sp-single-logout-url <string>

set sp-single-sign-on-url <string>

next

end

config fabric-idp

edit <device-id>

set idp-cert <string>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set idp-status {enable | disable}

next

end

end

Variable	Description
acs-url
auth-request-signed {enable | disable}	Enable/disable auth request signed (default = disable).
cert <certificate>	The certificate name.
default-profile <string>	The default profile (default = Restricted_User).
entity-id <string>	The entity ID.
forticloud-sso {enable | disable}	Enable/disable FortiCloud SSO (default = disable).
idp-cert <string>	The IDP certificate name.
idp-entity-id <string>	The IDP entity ID.
idp-single-logout-url <string>	The IDP single logout URL.
idp-single-sign-on-url <string>	The IDP single sign-on URL.
login-auto-redirect {enable | disable}	Enable/disable automatic redirect to the IDP login page (default = disable).
role {FAB-SP | IDP | SP}	The SAML role: FAB-SP: Fabric service provider IDP: Identity provider SP: Service provider (default)
server-address <string>	The server address.
sls-url
status {enable | disable}	Enable/disable SAML authentication (default = disable).
user-auto-create {enable | disable}	Enable/disable automatic user creation (default = disable).
want-assertions-signed {enable | disable}	Enable/disable want assertions signed (default = disable).
Variables for config service-providers subcommand: This command is only available when role is IDP.
<name>	Service provide name.
idp-entity-id <string>	The IDP entity ID.
idp-single-logout-url <string>	The IDP single logout URL.
idp-single-sign-on-url <string>	The IDP single sign-on URL.
prefix <string>	The prefix. Can contain only letters and numbers.
sp-adom <string>	The SP ADOM name.
sp-cert <string>	The SP certificate name.
sp-entity-id <string>	The SP entity ID.
sp-profile <string>	The SP profile name.
sp-single-logout-url <string>	The SP single sign-on URL.
sp-single-sign-on-url <string>	The SP single logout URL.
Variables for config fabric-idp subcommand: This command is only available when role is FAB-SP.
<device-id>	Device ID.
idp-cert <string>	The IDP certificate name.
idp-entity-id <string>	The IDP entity ID.
idp-single-logout-url <string>	The IDP single logout URL.
idp-single-sign-on-url <string>	The IDP single sign-on URL.
idp-status {enable | disable}	Enable/disable SAML authentication (default = disable).

To view the service provider IdP information, use the following commands:

config system saml

config service-providers

edit <name>

get

Output:

name : name

prefix : y9jr06vq0k

sp-cert : (null)

sp-entity-id : http://https://172.27.2.225//metadata/

sp-single-sign-on-url: https://https://172.27.2.225//saml/?acs

sp-single-logout-url: https://https://172.27.2.225//saml/?sls

sp-adom: (null)

sp-profile: (null)

idp-entity-id : http://172.27.2.225/saml-idp/y9jr06vq0k/metadata/

idp-single-sign-on-url: https://172.27.2.225/saml-idp/y9jr06vq0k/login/

idp-single-logout-url: https://172.27.2.225/saml-idp/y9jr06vq0k/logout/