saml

Use this command to configure global settings for SAML authentication.

Syntax

config system saml

set auth-request-signed {enable | disable}

set cert <certificate>

set default-profile <string>

set forticloud-sso {enable | disable}

set idp-cert <string>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set login-auto-redirect {enable | disable}

set logout-request-signed {enable | disable}

set logout-response-signed {enable | disable}

set role {FAB-SP | IDP | SP}

set server-address <string>

set status {enable | disable}

set user-auto-create {enable | disable}

set want-assertions-signed {enable | disable}

config service-providers

edit <name>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set prefix <string>

set sp-adom <string>

set sp-cert <string>

set sp-entity-id <string>

set sp-profile <string>

set sp-single-logout-url <string>

set sp-single-sign-on-url <string>

next

end

config fabric-idp

edit <device-id>

set idp-cert <string>

set idp-entity-id <string>

set idp-single-logout-url <string>

set idp-single-sign-on-url <string>

set idp-status {enable | disable}

next

end

end

Variable	Description
acs-url	The Assertion Consumer Service (acs) URL is set automatically once the server-address is configured. You can view the URL using the get command. This variable is only available when the role is FAB-SP or SP.
auth-request-signed {enable | disable}	Enable/disable auth request signed (default = disable).
cert <certificate>	The certificate name. This variable is only available when the status = enable and the role = IDP or SP.
default-profile <string>	The default profile (default = No_Permission_User).
entity-id	The entity ID is set automatically once the server-address is configured. You can view the entity ID using the get command. This variable is only available when the role is FAB-SP or SP.
forticloud-sso {enable | disable}	Enable/disable FortiCloud SSO (default = disable).
idp-cert <string>	The IDP certificate name. This variable is only available when the status = enable and the role = SP.
idp-entity-id <string>	The IDP entity ID. This variable is only available when the status = enable and the role = SP.
idp-single-logout-url <string>	The IDP single logout URL. This variable is only available when the status = enable and the role = SP.
idp-single-sign-on-url <string>	The IDP single sign-on URL. This variable is only available when the status = enable and the role = SP.
login-auto-redirect {enable | disable}	Enable/disable automatic redirect to the IDP login page (default = disable). This variable is only available when the status = enable and the role = SP.
logout-request-signed {enable | disable}	Enable/disable logout request signed (default = disable).
logout-response-signed {enable | disable}	Enable/disable logout response signed (default = disable).
role {FAB-SP | IDP | SP}	The SAML role: FAB-SP: Fabric service provider IDP: Identity provider SP: Service provider (default) This variable is only available when the status = enable.
server-address <string>	The server address.
sls-url	The Single Logout Service (sls) URL is set automatically once the server-address is configured. You can view the URL using the get command. This variable is only available when the role is FAB-SP or SP.
status {enable | disable}	Enable/disable SAML authentication (default = disable).
user-auto-create {enable | disable}	Enable/disable automatic user creation (default = disable). When SAML is configured with the FAB-SP role, the user-auto-create setting will default to enable. This setting must be enabled to automatically create an SSO admin to be used for the security fabric. This admin is created with the name "CSF_SSO_FG<serial number".
want-assertions-signed {enable | disable}	Enable/disable want assertions signed (default = disable).
Variables for config service-providers subcommand: This command is only available when role is IDP.
<name>	Service provide name.
idp-entity-id <string>	The IDP entity ID.
idp-single-logout-url <string>	The IDP single logout URL.
idp-single-sign-on-url <string>	The IDP single sign-on URL.
prefix <string>	The prefix. Can contain only letters and numbers.
sp-adom <string>	The SP ADOM name.
sp-cert <string>	The SP certificate name.
sp-entity-id <string>	The SP entity ID.
sp-profile <string>	The SP profile name.
sp-single-logout-url <string>	The SP single sign-on URL.
sp-single-sign-on-url <string>	The SP single logout URL.
Variables for config fabric-idp subcommand: This command is only available when role is FAB-SP.
<device-id>	Device ID.
idp-cert <string>	The IDP certificate name.
idp-entity-id <string>	The IDP entity ID.
idp-single-logout-url <string>	The IDP single logout URL.
idp-single-sign-on-url <string>	The IDP single sign-on URL.
idp-status {enable | disable}	Enable/disable SAML authentication (default = disable).

To view the service provider IdP information, use the following commands:

config system saml

config service-providers

edit <name>

get

Output:

name : name

prefix : y9jr06vq0k

sp-cert : (null)

sp-entity-id : http://https://172.27.2.225//metadata/

sp-single-sign-on-url: https://https://172.27.2.225//saml/?acs

sp-single-logout-url: https://https://172.27.2.225//saml/?sls

sp-adom: (null)

sp-profile: (null)

idp-entity-id : http://172.27.2.225/saml-idp/y9jr06vq0k/metadata/

idp-single-sign-on-url: https://172.27.2.225/saml-idp/y9jr06vq0k/login/

idp-single-logout-url: https://172.27.2.225/saml-idp/y9jr06vq0k/logout/