Bearer token authentication for SCIM servers

Bearer token authentication can be used for SCIM to improve security between the SCIM server and client. Bearer tokens generated by FortiOS can be temporary or long lived, and the SCIM client can verify the token.

Use the execute gen-token command to generate bearer tokens. The command is available for each VDOM.

execute gen-token <type> <string> <algorithm> <expire>

<type>	Type for token generation: cert: certificate key: pre-shared key
<string>	Name of the certificate or pre-shared key for token generation.
<algorithm>	Algorithm for token generation. Ensure that the signing algorithm supports the type. Available algorithms: When the type is cert: RS256, RS384, RS512, ES256, ES384, or ES512. When the type is key: HS256, HS384, or HS512.
<expire>	Expire interval, in hours (1 - 32767, 0 = long lived). When the token expires, administrators must manually generate another token on FortiGate and copy it to the SCIM client.

Use the config user scim command to configure token verification.

Example

This example explains how to generate a certificate type of bearer token and configure verification of the bearer token.

When generating a bearer token on FortiGate, remember:

• You can use any of the built-in or custom certificates available in the local certificate store.

• You must select a signing algorithm that supports the certificates.

• When the bearer token expires, the administrator must manually generate a new bearer token on FortiGate and copy the token to the SCIM client.

To generate a bearer token:

1. Enter execute gen-token cert to display the list of certificates available in the local certificate store:

   Custom and built-in certificates are displayed, and either can be used to generate tokens. In this example, FGT401E-II-SAN-all is a custom certificate, and Fortinet_CA_SSL is a built-in certificate.

   # execute gen-token cert
   <string>    Certificate or preshared-key for token generation. 
   Available certificates:
   FGT401E-II-SAN-all      local 
   Fortinet_CA_SSL     local 
   Fortinet_CA_Untrusted   local           "
   Fortinet_Factory        local           "
   Fortinet_Factory_Backup local
   Fortinet_GUI_Server     local           "
   Fortinet_SSL    local
   Fortinet_SSL_DSA1024    local
   Fortinet_SSL_DSA2048    local
   Fortinet_SSL_ECDSA256   local      
   Fortinet_SSL_ECDSA384   local
   Fortinet_SSL_ECDSA521   local
   Fortinet_SSL_ED448      local
   Fortinet_SSL_ED25519    local
   Fortinet_SSL_RSA1024    local
   Fortinet_SSL_RSA2048    local
   Fortinet_SSL_RSA4096    local

2. Enter ? to display additional information:

   # execute gen-token cert 
   Please specify <certificate or preshared-key> <algorithm> <expire>.
   

3. Enter the certificate name and ? to display additional information:

   In this example, the FGT401E-II-SAN-all certificate is specified.

   # execute gen-token cert FGT401E-II-SAN-all 
   <Algorithm>    Algorithm for token generation.
   Please ensure that the signing algorithm matches the type of certificate and its corresponding private key.
   Available Algorithms:
   RS256, RS384, RS512, ES256, ES384, ES512 for cert.  
   HS256, HS384, HS512 for key.

4. Enter the algorithm and ? to display additional information:

   In this example, the RS256 algorithm is specified.

   # execute gen-token cert FGT401E-II-SAN-all RS256
   <Expire>    Expire interval in hours, 0 for long live token.

5. Enter the expiration value:

   In this example, no expiration time (0) is specified.

   # execute gen-token cert FGT401E-II-SAN-all RS256 0

   The following values display after successful token generation:

   Added key:iat val:1732547333
   Generated token:eyAidHlwIjogIkpXVCIsICJhbGciOXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   

6. Copy the Generated token to your SCIM client.

   
   Generated token:eyAidHlwIjogIkpXVCIsICJhbGciOXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   

   • On FortiAuthenticator, the generated token is called an access token.

   • For Azure, the generated token is called a secret token.

To configure verification of the bearer token:

1. Configure the certificate name or pre-shared key to use for verification of the bearer token.

   In this example, a certificate (cert) type of bearer token is configured. You must specify the same certificate used to generate the bearer token:

   config user scim
       edit "SCIM-server-to-FAC"
           set id 1
           set status enable
           set base-url "https://10.1.100.7/SCIM-server-to-FAC/scim/v2/"
           set auth-method token
           set token-certificate "FGT401E-II-SAN-all"   
           set certificate "REMOTE_Cert_1"
           set client-identity-check disable
       next
   end

   When using a pre-shared key (key), you must specify the same value used to generate the bearer token, for example:

   config user scim
       edit "SCIM-server-to-FAC"
           set id 1
           set status enable
           set base-url "https://10.1.100.8/SCIM-server-to-FAC/scim/v2/"
           set auth-method token  
           set secret ENC mSoyZXvQ/tM1v1VOuS31DOrCZRNQ383JiXXXXXXXXXXXXXXXXXXXXX"
           set certificate "REMOTE_Cert_2"
           set client-identity-check disable
       next
   end