dynamic-ip-status {enable | disable}

Enable if the IdP uses dynamic client IP addresses, even within the same SAML session. (This can be useful, for example, if the IdP is deployed behind a load balancer.) Also configure dynamic-ip {<client_ipv4/mask>,...}.

dynamic-ip {<client_ipv4/mask>,...}

Enter the IdP's client IP addresses or subnet.If no IP range is specified, then any IP address is allowed.

This setting applies only if dynamic-ip-status {enable | disable} is enable.

For better security, only allow IdP communications from known IP addresses.

hostname {<service_fqdn> | <service_ipv4>}

Enter the FQDN or IP address that is the base of the SP ACS URL. That URL is where the IdP will respond to authentication requests from FortiMail services.

This setting may be optional unless multiple FQDN or IP addresses exist for FortiMail or if SSO is enabled via the CLI. (When SSO is enabled via the administrative GUI and you click Apply, this setting is automatically populated using the address that is in your browser.)

This setting is used in the SP ACS URL for both the administrative GUI and webmail, unless second-sp-status {enable | disable} is enable. If so, for webmail you must configure second-hostname {<service_fqdn> | <service_ipv4>}.

This address must be globally DNS-resolvable and routable, including by FortiMail. Otherwise when you try to download the SP metadata, there is an error message: File does not exist or is invalid.

second-hostname {<service_fqdn> | <service_ipv4>}

Enter the FQDN or IP address that is the base of the SP ACS URL. This is where the IdP will respond to authentication requests from the FortiMail webmail or personal quarantine service.

This setting applies only if second-sp-status {enable | disable} is enable.

second-sp-entity-id <entity-id_str>

Enter the globally unique entity identifier for FortiMail webmail when it connects to the IdP, such as:

https://fortimail.example.com/sp2

This setting applies only if second-sp-status {enable | disable} is enable.

second-sp-status {enable | disable}

Enable if you want to configure a different SP ACS URL and metadata for the webmail and personal quarantine service. (This can be useful, for example, if the IdP needs to identify those services separately.) Also configure second-sp-entity-id <entity-id_str> etc.

sp-entity-id "<entity-id_str>"

Enter the globally unique entity identifier used by the IdP to identify the FortiMail owner and SP, such as:

https://fortimail.example.com/sp

This setting may be optional, unless your IdP requires a specific name or format because it is the central control point for federated SPs, or if you have customized the SAML hostname {<service_fqdn> | <service_ipv4>} and want it to match.(When SSO is enabled, this setting is automatically populated using the values of hostname <host_str> and local-domain-name <domain-name_str>.)

This setting is used for both the administrative GUI and webmail or personal quarantine access, unless second-sp-status {enable | disable} is enable. If so, for webmail you must configure second-sp-entity-id <entity-id_str>.

The entity ID is not required to be resolvable by DNS. (The entity ID is a URI, not a URL.)