External IdP Roles

FortiDevSec supports integration of third-party Identity Provider (IdP) services to log-in and manage networks. This feature is useful for enterprises that need to secure their user credentials and hence provision FortiDevSec access through their own Identity Provider. The external IdP initiated Security Assertion Markup Language (SAML) assertion consisting of specific IdP attributes is used by FortiCloud/FortiDevSec to verify the user account details and grant required access.

Configuring External IdP

The graphic below depicts an overview of configuring the external IdP.

External IdP authentication is offered in conjunction with FortiCare and FortiAuthenticator. To configure external IdP support perform the following steps:

1. Contact the Fortinet Customer Support team and request External IdP support.

2. Provide the required information and initiate enrollment with the appropriate FortiCare accounts.

   1. Create an IDP with SAML Service Provider Metadata. You'll need to provide specific URLs for SP Entity ID, Login URL, and Relay State. Support for SAML 2.0 and IDP-initiated assertion response is necessary. The following is an example where company is the unique name of your organization.
      SP Entity ID http://customersso1.fortinet.com/saml-idp/proxy/{company}/metadata/
SP Login URL https://customersso1.fortinet.com/saml-idp/proxy/{company}/saml/?acs
Relay State https://customersso1.fortinet.com/saml-idp/proxy/{company}/login/
      

   2. Configure the SAML assertions with the username and role attributes for permission control in FortiCloud.
      Notes:

      • FortiDevSec currently supports a single user role named Admin and a single access type named Admin.

      • The role name configured must exactly match the role attribute defined in FortiDevSec. For FortiDevSec the role attribute defined is Admin(case-sensitive).

   3. In the enrollment form, provide specific information to Fortinet, such as, the SAML Metadata file, company name, contact information, and the Fortinet master account registered in FortiCloud that the IdP requires to connect to.

3. Wait for confirmation of enrollment completion from Fortinet. After successful enrollment, configure external IdP roles in FortiCloud to grant the required access.

4. To add an external IdP role, access the Identity & Access Management (IAM) service from the FortiCloud portal and perform the following steps:
   Note: Ensure the permission profile is created before adding an external IdP role. See, Adding Permission Profiles.

   1. Navigate to Users > Add New and click Extenal IdP User.

   2. Enter Admin(case-sensitive) as Role Name and Description (optional).
      

   3. Select an asset group from the Asset Permissions list.

   4. Select the Permission profile.

   5. Click Add Role.
      After the role is created, it is listed on the on the Manage External IdP Roles page. You can enable/disable or delete a created role. Select the role and click on the required option.

Note: FortiCloud's IdP user modifications require a minimum of 15 minutes before they are reflected on FortiDevSec.