Configuring FortiAuthenticator as a SAML IdP

To configure FortiAuthenticator as a SAML IdP:

1. Log in to FortiAuthenticator.
2. Go to Authentication > SAML IdP > General.

   The Edit SAML Identity Provider Settings window opens.

3. Toggle on Enable SAML Identity Provider portal.
4. In Server address, enter the FQDN of the FortiAuthenticator device.
5. In the Default IdP certificate dropdown, select the Default-Server-Certificate exported in Importing FortiAuthenticator certificate to FortiPAM.
6. Click OK.

   

To configure SP settings on FortiAuthenticator:

1. In FortiAuthenticator, go to Authentication > SAML IdP > Service Providers and select Create New to create a new SAML SP.
2. In SP name, enter a name for the FortiPAM SP.
3. In IdP prefix, select + and enter an IdP prefix. Alternatively, you can select Generate prefix in the Create Alternate IdP Prefix dialog to generate a random 16 digit alphanumeric string.

   IdP entity id, IdP single sign-on URL, and IdP single logout URL are automatically filled in.

4. In Server certificate, select the Default-Server-Certificate exported in Importing FortiAuthenticator certificate to FortiPAM.
5. In the IdP signing algorithm dropdown, select SHA-256 signing algorithm.
6. Enable participation in single logout for the SAML IdP service.
7. In Authentication method, select Password-only.
8. Click Save.
9. In the SP Metadata pane:
   1. In SP entity ID, enter the FortiPAM SP entity ID.
   2. In SP ACS (login) URL, enter the FortiPAM SP Assertion Consumer Service (ACS) login URL.
   3. In SP SLS (logout) URL, enter the FortiPAM SP Single Logout Service (SLS) logout URL.

      SP entity ID, SP ACS (login) URL, and SP SLS (logout) URL values are same as those in the Configure Service Provider tab when Configuring FortiPAM as an SP.

   For example:

   SP entity ID- http://[PAM_IP]/saml/metadata

   SP ACS (login) URL- https://[PAM_IP]/XX/YY/ZZ/saml/login/

   SP SLS (logout) URL- https://[PAM_IP]/remote/saml/logout/

10. In the Assertion Attributes pane:
    1. Select Add Assertion Attribute.
    2. In SAML attribute, enter username.
    3. In the User attribute dropdown, select Username.
    4. Similarly, add another attribute with SAML attribute as group and User attribute as Group.
11. Click OK.