Advanced tenant control

Advanced tenant control allows administrators to go beyond simple tenant restriction by performing granular manipulation of HTTP headers—including adding, modifying, or deleting request headers. By defining custom SaaS applications and user activities, administrators can inject specific metadata (such as business unit, location, or tenant IDs) into the traffic flow for better visibility or compliance at the destination SaaS application.

To configure a customized inline CASB profile with advanced tenant control:

1. Configure the CASB SaaS application:

   config casb saas-application
       edit "httpbin"
           set domains "httpbin.org"       
           config input-attributes
               edit "business_name"
               next
               edit "city"
               next
               edit "province"
               next
           end
       next
   end

2. Configure the CASB user activity:

   config casb user-activity
       edit "httpbin-tenant"
           set application "httpbin"
           set category advanced-tenant-control
           config control-options
               edit "tenant-control"
                   config operations
                       edit "add_header1"
                           set action new-on-not-found
                           set header-name "X-Business-Name"
                           set value-from-input enable
                           set value-name-from-input "business_name"
                       next
                       edit "add_header2"
                           set action new-on-not-found
                           set header-name "X-City"
                           set value-from-input enable
                           set value-name-from-input "city"
                       next
                       edit "add_header3"
                           set action new-on-not-found
                           set header-name "X-Province"
                           set value-from-input enable
                           set value-name-from-input "province"
                       next
                   end
               next
           end
       next
   end

3. Configure the inline CASB profile:

   config casb profile
       edit "advanced_casb"
           config saas-application
               edit "httpbin"
                   set tenant-control enable
                   config advanced-tenant-control
                       edit "httpbin-tenant"
                           config attribute
                               edit "business_name"
                                   set input "Pochiya Limited"
                               next
                               edit "city"
                                   set input "Coquitlam"
                               next
                               edit "province"
                                   set input "BC"
                               next
                           end
                       next
                   end
               next
           end
       next
   end

4. Configure the firewall policy:

   config firewall policy
       edit 1
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "deep-inspection"
           set casb-profile "advanced_casb"
           set schedule "always"
           set service "HTTPS"
           set action accept
       next
   end
   

Verification

To verify that the headers are being injected correctly, perform a request from a client behind the FortiGate to the configured domain using curl:

# curl -k https://httpbin.org/headers
{
  "headers": {
    "Accept": "*/*", 
    "Host": "httpbin.org", 
    "User-Agent": "curl/7.68.0", 
    "X-Business-Name": "Pochiya Limited", 
    "X-City": "Coquitlam", 
    "X-Province": "BC"
  }
}

The successful verification of the custom headers (X-Business-Name, X-City, and X-Province) confirms that the FortiGate is successfully intercepting the HTTPS traffic, identifying the SaaS application context, and performing real-time header manipulation.