Fortinet black logo

Cookbook

Configuring the remote SAML server

Copy Link
Copy Doc ID 23809264-eafe-11eb-97f7-00505692583a:660887
Download PDF

Configuring the remote SAML server

To configure the remote SAML server:
  1. Go to Remote Auth. Servers > SAML, and click Create New.
    The server name must match the one created in https://portal.azure.com/. For example, if the name in Azure is set as AZIdP, the SAML server should also use AZIdP (case sensitive).
  2. For the Entity ID, click the dropdown menu and select the Azure IdP option.
  3. Import the IdP metadata from Azure. To download and import the Azure federation metadata:
    1. In Azure, go to Azure Active Directory > App Registrations and select the application being used for SAML authentications for your FortiAuthenticator.
    2. In Endpoints, select the federation metadata document, enter the URL into the browser, and save it as an XML file.
    3. Click Import IDP metadata/certificate, and upload the federation metadata file.
  4. In Group Membership, select Cloud and choose the previously created Azure OAuth server.
  5. At the top of the page, select Proxy as the Type, and copy the Portal URL to be used later when customizing the replacement message.

  6. Click OK to save your changes.

Configuring the remote SAML server

To configure the remote SAML server:
  1. Go to Remote Auth. Servers > SAML, and click Create New.
    The server name must match the one created in https://portal.azure.com/. For example, if the name in Azure is set as AZIdP, the SAML server should also use AZIdP (case sensitive).
  2. For the Entity ID, click the dropdown menu and select the Azure IdP option.
  3. Import the IdP metadata from Azure. To download and import the Azure federation metadata:
    1. In Azure, go to Azure Active Directory > App Registrations and select the application being used for SAML authentications for your FortiAuthenticator.
    2. In Endpoints, select the federation metadata document, enter the URL into the browser, and save it as an XML file.
    3. Click Import IDP metadata/certificate, and upload the federation metadata file.
  4. In Group Membership, select Cloud and choose the previously created Azure OAuth server.
  5. At the top of the page, select Proxy as the Type, and copy the Portal URL to be used later when customizing the replacement message.

  6. Click OK to save your changes.