Configuring FortiPAM as an SP

To configure FortiPAM as an SP:

1. Go to User Management > Saml Single Sign-On.
2. In the Configure Service Provider tab, keep the default values.

   Ensure that the FortiAuthenticator IdP uses the same configuration as in Configure Service Provider tab in SP Metadata when Configuring FortiAuthenticator as a SAML IdP: FortiPAM FortiAuthenticator Entity ID SP entity ID Single Logout Service (SLS) URL SP SLS (logout) URL Portal (Sign On) URL SP ACS (login) URL

3. Click Next.
4. In the Configure Identity Provider tab:
   1. In Type, select Custom.
   2. In IdP entity ID, enter the FortiAuthenticator IdP entity ID.
   3. In IdP single sign-on URL, enter the FortiAuthenticator IdP login URL.
   4. In IdP single logout URL, enter the FortiAuthenticator IdP logout URL.

      IdP entity ID, IdP single sign-on URL, and IdP single logout URL were initially configured in Configuring FortiAuthenticator as a SAML IdP.

   5. In the IdP Certificate dropdown, select the remote certificate imported in Importing FortiAuthenticator certificate to FortiPAM.
   6. Click Next.
5. In the Additional Saml Attributes tab:
   1. In Attribute used to identify users, enter username.
   2. In Attribute used to identify groups, enter group.

      These attributes are the same as those configured in the Assertion Attributes pane when Configuring FortiAuthenticator as a SAML IdP.

6. Click Next.
7. In the Review tab, verify the information you entered and click Submit.