status {enable | disable}

Enable or disable SSO.

dynamic-ip {<client_ipv4/mask>,...}

Enter the IdP's client IP addresses or subnet in CIDR or dotted decimal format. Separate multiple IP addresses or subnets with a comma. Spaces are not allowed. If no IP range is specified, then any IP address is allowed.

For better security, only allow IdP communications from known IP addresses.

dynamic-ip-status {enable | disable}

Enable if the IdP uses dynamic client IP addresses, even within the same SAML session. (This can be useful, for example, if the IdP is deployed behind a load balancer.) Also configure dynamic-ip {<client_ipv4/mask>,...}.

sp-entity-id "<entity-id_str>"

Enter the globally unique entity identifier used by the IdP to identify the FortiMail owner and SP, such as:

https://fortimail.example.com/sp

This setting may be optional, unless your IdP requires a specific name or format because it is the central control point for federated SPs. (When SSO is enabled, this setting is automatically populated using the values of hostname <host_str> and local-domain-name <name_str>.)

This setting is used for both the administrative GUI and webmail or personal quarantine access, unless second-sp-status {enable | disable} is enabled.

The entity ID is not required to be resolvable by DNS. (The entity ID is a URI, not a URL.)

second-sp-status {enable | disable}

Enable if you want to configure a different SP ACS URL and metadata for the webmail and personal quarantine service so that it is separate from the administrative GUI. (This can be useful, for example, if the IdP needs to identify those services separately.) Also configure second-sp-entity-id "<entity-id_str>".