system saml
Use this command to configure FortiMail to act as a SAML SSO service provider (SP).
In Security Assertion Markup Language (SAML) SSO, you must configure both of these to connect and authenticate with each other:
- FortiMail, which is the service provider (SP)
- FortiAuthenticator or other remote authentication server, which is the identity provider (IdP). See profile sso.
When you enable SSO, FortiMail automatically generates its SP metadata XML, entity ID, and ACS URL. (To download them, use the GUI.)
Syntax
config system saml
set dynamic-ip-status {enable | disable
set dynamic-ip {<client_ipv4/mask>,...}
end
|
Variable |
Description |
Default |
|
Enable or disable the feature. |
disable |
|
|
Enter the IdP's client IP addresses or subnet in CIDR or dotted decimal format. Separate multiple IP addresses or subnets with a comma. Spaces are not allowed. If no IP range is specified, then any IP address is allowed. Tip: For better security, only allow IdP communications from known IP addresses. |
|
|
|
Enable if the IdP uses dynamic client IP addresses, even within the same SAML session. (This can be useful, for example, if the IdP is deployed behind a load balancer.) Also configure dynamic-ip {<client_ipv4/mask>,...}. |
disable |