Configuring Microsoft Entra ID as SAML IdP and FortiGate as SAML SP

This topic discusses the configurations steps required if your users are managed through Microsoft Entra ID (formerly Azure Active Directory), as a part of the overall configuration in SAML-based authentication for FortiClient remote access dialup IPsec VPN clients. Microsoft Entra ID will be configured as Identity Provider (IdP) and FortiGate as Service Provider (SP) during SAML Authentication for IPsec connection.

To configure a user on Microsoft Entra ID:

1. Login to the Azure portal (portal.azure.com).

2. Search for Microsoft Entra ID service in the search bar and click on it.

3. In the left side menu, go to Users.

4. Select New user > Create new user.

5. In the Basic properties:

   1. In the Display name field, enter testuser.

   2. In the User principal name field, enter the username@companydomain.extension. For example, testuser@<mydomain>.onmicrosoft.com.

   3. Select Show password and then write down the value that's displayed in the Password box.

   4. Select Review + create.

6. Select Create.

To configure a Security group and add user to it on Microsoft Entra ID:

In this section, we create a security group named IT in Microsoft Entra ID for the testuser. FortiGate will use this security group to grant the user network access through the VPN.

1. In the Azure portal, navigate to Microsoft Entra ID service.

2. In the left side menu, go to Groups.

   1. Select New Group.

   2. In the Group type list, select Security.

   3. In the Group name field, enter IT.

   4. (Optional) In the Group description field, enter Group for granting FortiGate VPN access.

   5. For the Microsoft Entra roles can be assigned to the group (Preview) settings, select No.

   6. In the Membership type field, select Assigned.

   7. Under Members, select No members selected.

   8. In the Users and groups dialog field, select testuser from the Users list, and then click Select.

   9. Select Create.

3. Back in the Groups section in Microsoft Entra ID, find the IT group and note the Object Id. This will be needed later.

To configure Enterprise application on Azure portal:

1. Configure user and groups:

   1. In the Azure portal, search for Enterprise applications service in the search bar.

   2. Click on New application and search for FortiGate SSL VPN.

      The application is named for “SSL VPN” but should still work with the IPsec VPN configuration.

   3. Once the application is found, select it, change the Name to FortiGate IPsec VPN, and click Create. It may take a few seconds to create the application.

   4. Once the application is created, go to Enterprise application > All applications > FortiGate IPsec VPN.

   5. On the application's overview page, in the Manage section, select Users and groups.

   6. Select Add user/group, then select Users in the Add Assignment dialog.

   7. In the Users and groups dialog, select testuser in the Users list, and then click Select.

   8. (Optional) If you are expecting any role value in the SAML assertion, in the Select Role dialog, select the appropriate role for the user from the list. Click Select.

   9. In the Add Assignment dialog, select Assign.

2. Configure single sign-on:

   1. Browse to Enterprise application > All applications > FortiGate IPsec VPN application.

   2. In the Manage section, select Single sign-on.

   3. In the Select a single sign-on method page, select SAML.

   4. In the Set up Single Sign-On with SAML page, select Edit for Basic SAML Configuration to edit the settings:

      

      1. In Identifier, enter a URL in the pattern https://<FortiGate IP or FQDN address>:<Custom SAML-IKE port>/remote/saml/metadata

      2. In Reply URL, enter a URL in the pattern https://<FortiGate IP or FQDN address>:<Custom SAML-IKE port>/remote/saml/login

      3. In Sign on URL, enter a URL in the pattern https://<FortiGate IP or FQDN address>:< Custom SAML-IKE port >/remote/saml/login

      4. In Logout URL, enter a URL in the pattern https://<FortiGate IP or FQDN address>:< Custom SAML-IKE port >/remote/saml/logout

         These URLs can be retrieved and copied directly from the FortiGate. Go to To configure SAML server on FortiGate: to get these URLs.

   5. Click Save.

   6. The FortiGate IPsec VPN application expects SAML assertions in a specific format, which requires you to add custom attribute mappings to the configuration.

   7. The claims required by FortiGate IPsec VPN are shown in the following table. Names are case-sensitive.

      

      To create these additional claims:

      1. Next to User Attributes & Claims, select Edit.

      2. Select Add new claim.

      3. For Name, enter username.

      4. For Source attribute, select user.userprincipalname.

      5. Select Save.

      6. Select Add a group claim.

      7. Select All groups.

      8. Under Advanced options, select the Customize the name of the group claim.

      9. For Name, enter group.

      10. Select Save.

   8. In the Set up Single Sign-On with SAML page, in the SAML Signing Certificate section, select Download next to Certificate (Base64) to download the certificate and save it on your computer. This will be needed in the step To export SAML IdP server certificate and import it on FortiGate:

      

   9. In the Set up FortiGate SAML IPsec section, copy the URLs (Login URL, Microsoft Entra Identifier, Logout URL) and paste it inside FortiGate’s SAML server configuration, discussed in To configure SAML server on FortiGate:.

      

To export SAML IdP server certificate and import it on FortiGate:

1. On FortiGate, go to System > Certificates, and from the Create/Import dropdown, select Remote Certificate.

2. Select Upload to locate and upload the .cer remote certificate from your computer.

3. Click OK. The certificate will now be visible under System > Certificates > Remote Certificate.

To configure SAML server on FortiGate:

1. On the FortiGate, go to User & Authentication > Single Sign-On > Create new.

2. Enter the Name as saml-entra-id.

3. In the Address field, enter the FQDN/IP information in the following format:

   <ipsec-vpn-gateway-fqdn/ip-address>:<saml-ike-authentication-port>

   The Address field is used by FortiClient to initiate IPsec connection to FortiGate.

4. In Service Provider Configuration, copy the following URLs (Entity ID, Assertion consumer service URL, Single logout service URL) and use it in Azure in Enterprise application > All applications > FortiGate IPsec VPN > Single sign-on page > Basic SAML Configuration. Use the following mapping to copy the required values:

   FortiGate settings	Microsoft Entra ID settings
   Entity ID	Identifier (Entity ID)
   Assertion consumer service URL	Reply URL (Assertion Consumer Service URL)
   Assertion consumer service URL	Sign on URL
   Single logout service URL	Logout URL (Optional)

   The following demonstrates on the FortiGate:

   

   The following demonstrates on Microsoft Entra ID:

   

5. On the FortiGate GUI, click Next.

6. In Identity Provider Details, set the Type as Custom.

7. Paste the URLs copied from last step of section To configure Enterprise application on Azure portal: according to the following mapping:

   Microsoft Entra IDsettings	FortiGate settings
   Login URL	Assertion consumer service URL
   Microsoft Entra Identifier	Entity ID
   Logout URL	Single logout service URL

8. Select the Certificate from the dropdown. This certificate was imported into FortiGate in section To export SAML IdP server certificate and import it on FortiGate:.

9. In the Additional SAML Attributes section, enter the following attributes:

   Attribute used to identify users	username
   Attribute used to identify groups	group

10. Click Submit to save the changes.

To configure SAML user group on FortiGate:

1. Go to User & Authentication > User Groups > Create New.

2. Enter Name as SAML-ENTRA-ID-Group.

3. In Remote Groups, click Add.

4. From the Remote Server dropdown, select saml-entra-id SAML server.

5. In Groups, click Specify and paste the Object ID copied in the section To configure a Security group and add user to it on Microsoft Entra ID:.

   

6. Click OK.

7. Click OK.

To associate SAML server with IPsec gateway interface:

Use the FortiGate CLI to bind and associate the SAML server with the VPN gateway interface (port1) as follows:

config system interface
    edit "port1"
        set ike-saml-server "saml-entra-id"
    next
end

Configuring SAML on IdP and SP is now complete. The next step is to use SAML configuration inside IPsec configuration. To configure IPsec, see Configuring IPsec IKEv2 on FortiGate.