Example 6: ZTNA application gateway with SAML as SP

1. Complete the initial setup by following the instructions in Configure ZTNA HTTPS access proxy.
2. Create a new SAML user/server on FortiGate GUI:
   1. On the FortiGate, click User & Authentication > Single Sign-On.
   2. Click Create New.

   3. Set Address to webserver.ztnademo.com:9443.

      Note: The Entity ID, Assertion consumer service URL, and Single logout service URL will be updated.

   4. Take note of the aforementioned updates, for you will be prompted to enter them into FIC.

   5. Enable Certificate, and select the certificate used for the client.

      In this example, the ztna-wildcard certificate is a local certificate that is used to sign SAML messages that are exchanged between the client and the FortiGate SP.

      

   6. Click Next.

   7. Use the settings from FIC to fill the custom Identity Provider Details. On FIC, go to Applications > SSO > Add SSO Application, and get the IdP Metadata details from the page:

      • Where the REMOTE_Cert_1 certificate is a remote certificate that is used to identify the IdP. You’ll want to use the certificate you get from after you create the FIC SSO application if you click the tool icon, select Details , and click to download the Signing Certificate.

      • In the meantime, on FIC fill out the SP Metadata section with the Entity ID, Assertion consumer service URL and Single logout service URL:

        

   8. Set Attribute used to identify users to username. (Note: Attributes to identify users and groups are case-sensitive.)

      

   9. Click Submit to save the settings.
3. Create a user group for the SAML user object:
   1. Click User & Authentication > User Groups > Create New.
   2. Set Name to ztna-saml-users.
   3. Under Remote Groups, click Add.
   4. For Remote Server, select ZTNA-FAC-SAML.
   5. Click OK.
   6. Click OK again to save the settings.
4. Apply the SAML sever to proxy authentication:
   1. Go to Policy & Objects > Authentication Rules.
   2. Click Create New > Authentication Scheme.
   3. Set Name to ZTNA-SAML-scheme.
   4. Set Method to SAML.
   5. Set SAML SSO server to ZTNA-FAC-SAML.
   6. Click OK.
   7. Go to Policy & Objects > Authentication Rules.
   8. Click Create New > Authentication Rule.
   9. Set Name to ZTNA-SAML-rule.
   10. Set Source Address to all.
   11. Set Incoming Interface to port3.
   12. Set Protocol to HTTP.
   13. Enable Authentication Scheme and select ZTNA-SAML-scheme.
   14. Set IP-based Authentication to Disable.
   15. Click OK.
5. Configure the active authentication scheme and captive portal:
   1. Go to User Authentication > Authentication Settings.
   2. Enable Authentication scheme.
   3. Select ZTNA-SAML-scheme.
   4. Set Captive portal type to FQDN.
   5. Enable Captive Portal.
   6. Select the firewall address webserver.ztnademo.com. (Note: Choose this firewall address if you have not already done so.)
   7. Click Apply to save the configuration.
6. Configure a ZTNA application gateway to allow SAML authentication requests to the SP:
   1. Configure the ZTNA server:
      1. Go to Policy & Objects > ZTNA > ZTNA Servers > Create New.

      2. Configure the following:

         Parameter	Description
         Name	ZTNA-access
         Interface	Any
         IP	10.0.3.10
         Port	9443
         SAML	Enabled
         SAML SSO Server	ZTNA-FAC-SAML
         Default certificate	ztna-wildcard

      3. Click OK.

   2. Define the full ZTNA policy to allow access tto the ZTNA server:
      1. Go to Policy & Objects > Proxy policy > Create New.

      2. Configure the following:

         Parameter	Description
         Name	ZTNA-Rule
         Type	ZTNA
         Incoming Interface	port3
         Source (Address)	all
         Source (User)	ztna-saml-users
         Destination	all
         ZTNA Server	ZTNA-access
         Action	Accept
         Log Allowed Traffic	All Sessions

      3. Click OK.

      Once all of the aforementioned configurations are completed on your FGT and the SAML application and User Source(s) are set up on FIC, end-users should be able to start going through the FIC SAML login process when trying to access web servers through ZTNA.