SAML SSO with Okta as IdP

You can configure a single sign on (SSO) connection with Okta via SAML, where Okta is the identity provider (IdP) and FortiClient EMS is the service provider (SP). This feature allows administrators to log in to EMS by logging in with their Okta credentials.

To configure FortiClient EMS with Okta SSO:

1. In FortiClient EMS, go to Administration > SAML SSO.
2. Toggle on Enable SAML SSO. Service Provider Settings displays the SP entity ID. You use these values to configure FortiClient EMS as an SP in Okta. Copy these values.
3. Create and configure your FortiClient EMS environment in Okta:
   1. Add the FortiClient EMS application to Okta:
      1. On the Okta administration page, go to Applications.
      2. Click Add Application.
      3. In the searchbox, search for and select FortiClient EMS.
      4. Click Add.
      5. Under General Settings, click Done.
   2. On the Assignment tab, from the Assign dropdown list, select Assign to People.
   3. In the dialog, assign the desired users to the FortiClient EMS Okta application.
   4. On the Sign On tab, click Edit.
   5. Paste the entity ID value from FortiClient EMS in the Base URL field in Okta.
   6. Click Save.
4. Obtain the IdP information from Okta:
   1. On the Sign On tab in Okta, click View Setup Instructions.
   2. Scroll to step 5. This step lists the IdP information that you must provide to FortiClient EMS. Copy the values in the IdP Entity ID and IdP Single Sign-On URL fields.
   3. Download the IdP certificate from the provided link. Save the certificate to your device.
5. Configure the IdP information in FortiClient EMS:
   1. In FortiClient EMS, in the IdP Entity ID and IdP single sign-on URL fields, paste the values that you copied from the IdP Entity ID and IdP Single Sign-On URL fields, respectively.
   2. (Optional) If desired, configure the Assertion Attributes > Username Claim field. Only configure this option if you want to use a value other than username.
   3. From the IdP Certificate dropdown list, select Create, then upload the certificate that you downloaded. Click Next.

6. In Access Control, click Add to assign the roles for the group members:

   1. Create a member with the Super Administrator role and the highest Priority.

   2. Assign the access of other group members.

   3. For each Rule that is not assigned to a Super Administrator role, click Advanced Settings:

      1. Configure domain access. This enables finer control over the specific authorization levels assigned to administrators.

      2. Click Finish.

   4. Configure other settings as needed.

   5. Click Save.

      Deleting an authorization rule does not remove its associated users as admin users from EMS. You must delete them from Administration > Admin Users.

7. Review the SAML configuration, then click Save.