Generic OAuth/OIDC

FortiGuest leverages the OAuth 2.0 and OpenID Connect (OIDC) protocols for secure communication. OAuth is an open standard for authorization. It provides third-party applications with limited access to secure resources without compromising the user’s data or credentials. OIDC is an authentication protocol that verifies a user's identity when a user tries to access some resources. OIDC was developed to work together with OAuth by providing an authentication layer to support the authorization layer provided by OAuth.

FortiGuest obtains the OAuth access token and OIDC ID token from the specified OIDC authorization endpoint. The access token generated by OAuth is used to authorize access to resources, such as applications and servers, on a limited basis. The OIDC ID token enables authentication to OAuth, which is issued as a JSON Web Token (JWT). ID tokens are the defining component of the OIDC protocol.

When the OAuth/OIDC server is configured for authentication, an icon is displayed on the captive portal home page. On successful login into the captive portal, the guest clicks on this icon and is directed to the IdP to authenticate with this server.

The following are the supported callback URLs for authentication.

• Admin portal - https://{FortiGuest FQDN}/api/v1/oauth/oidc_callback

• Guest portal - https://{FortiGuest FQDN}/cp/portal/v1/cp/oidc/callback

The following are the supported callback URLs for logout.

• Admin portal - https://{FortiGuest FQDN}/api/v1/oauth/oidc/logout_callback

• Guest portal - https://{FortiGuest FQDN}/cp/portal/v1/cp/oidc/logout_callback

The FortiGuest user interface allows administrators to add custom OAUTH2/OpenID Connect IdPs, select Generic OAuth/OIDC as the Server Type and update the following settings.

• Client ID and Client Secret - The client ID and secret required for authentication.

• Authorization Endpoint - The public URL of the OIDC authorization endpoint.

• Token Endpoint - The public URL of the OIDC token endpoint.

• JWKS Endpoint - The public URL of the OIDC JWKS endpoint.

• End Session Endpoint - The public URL of the session logout.

• Scope - The scope admin wants to request from the user during login. Multiple scopes are allowed as comma-separated strings, for example, openid, email, profile.
  Note: Ensure to include openid in the scope.
  

• Issuer - This is the public URL of the IdP.

• Login Button Label - The label (text) to appear on the login button.

Optionally, you can specify some additional attributes that FortiGuest uses to verify authentication attempts. Configure your IdP to include them as OIDC attributes.

Note: Ensure to include oidc as realm in the guest portal's Realm Policy.