SAML

SAML authentication allows a user to complete authentication and authorization between a Service Provider (SP) and an Identity Provider (IdP). It enables Single Sign-On (SSO) by allowing users who have been authenticated against an IdP to be allowed access to different applications (the SPs providing a service such as a web application).

A FortiGate (SP) can provide a web service, such as an SSL VPN connection, that requires users to be authenticated through SAML. The user identities for the company can be stored remotely in an IdP, such as Microsoft Entra ID. Other applications might also require authentication from the same IdP, so after a user is authenticated once, the same SAML assertion carrying user and group information can be used to authorize the user access to the FortiGate SSL VPN, as well as other applications.

To illustrate the communication between the user or browser, SP, and IdP:

1. The user initiates an SSL VPN connection to the FortiGate.

2. The FortiGate SP redirects the user to the SAML IdP.

3. The user connects to the Microsoft log in page for the SAML authentication request.

4. The SAML IdP authenticates the user and sends the SAML assertion containing the user and group.

5. The browser forwards the SAML assertion to the FortiGate SP. If the user and group are allowed by the FortiGate, the user is allowed to access the application, in this case, connecting to SSL VPN.

Usage

There are many practical uses and applications for SAML authentication on the FortiGate. For example:

• Authentication for SSL VPN

• Authentication for IPsec VPN (with compatible FortiClient endpoint 7.2.4 and above)

• Firewall authentication for firewall policy access

• Authentication for ZTNA

• Authentication for Explicit Proxy

• Authentication for Administrative Access

Identity providers

FortiGate’s SAML SSO configurations can be integrated with any common Identity providers, such as Microsoft Entra ID, Okta, Google Workspace, Onelogin, and others. You can also use FortiAuthenticator as an identity provider with local or remote user integration, or as an IdP Proxy to other IdP providers.

For more information on using FortiAuthenticator, see the FortiAuthenticator Administration Guide and FortiAuthenticator Examples Guide.