Remote authentication: SSO

For single sign-on (SSO), FortiPortal supports both service provider (SP) initiated and identity provider (IdP) initiated SAML authentication.

For more information about how user and tenant identification works, see Tenant identification and domains.

To configure your SAML IdP server:

1. Set custom attributes to identify what fields in the SAML assertion will hold the needed values:

   FortiPortal field	Example attribute name	Example attribute value	Description
   Role Attribute	FPC_Role	user.jobtitle	Used to map the IdP server roles to FortiPortal profiles. Required.
   Site Attribute	FPC_Site	user.officelocation	Used to restrict an account to a specific site or location. Optional.
   Tenant Identification Attribute	FPC_Tenant	user.companyname	Defines the field in the SAML assertion that holds the user's domain name, which is then used to map to an organization or administration domain. Optional. See Tenant identification and domains for more information.
   Email Attribute	FPC_Email	user.mail	Defines the field in the SAML assertion that holds the user's email address, which is then used to map to an organization or administration domain if Tenant Identification Attribute is not set and the username is not in email format. Optional.

2. Configure other options as needed.

3. Consult the documentation for your IdP provider for more information.

By default, FortiPortal requires that all SAML responses and assertions are signed. To enable signing in Azure AD, edit Token signing certificate and set Signing Option to Sign SAML response and assertion. Disable required signing of responses and assertions using Require Response Signed from IdP and Require Assertion Signed from IdP.

To configure FortiPortal:

1. Go to System > Settings > Authentication.

2. Configure the settings as follows:

   Field	Required	Description
   Authentication Access	N	Set to Remote.
   Enable Two-factor Authentication	N	Do not enable two-factor authentication with SSO in FortiPortal. To use two-factor authentication with SSO, select the Remote authentication access and SSO and configure two-factor authentication on the SAML IdP server.
   Remote Server	Y	Select SSO.
   SSO IdP Entity URL	Y	Enter the URL of your SSO provider entity identifier. The name of this field on your provider may vary. For example, in Azure AD, this value is found in the Azure AD Identifier field.
   IdP Sign On Service Endpoint URL	Y	Enter the sign-on endpoint URL as provided by your SSO provider. For example, in Azure AD, this value is found in the Login URL field.
   IdP Sign on Service Redirect Endpoint URL	Y	This value is usually the same as the IdP Sign On Service Endpoint URL.
   SSO Application ID	Y	Enter the application ID as set in your IdP configuration. This is usually https://<portal>/fpc/saml/metadata.
   SSO Audience URL	Y	Enter the value from the sign on URL as set in your IdP configuration. This is usually https://<portal>/fpc/saml/SSO.
   Role Attribute	Y	Enter the value as set in your IdP configuration. See Role Attribute.
   Tenant Identification Attribute	N	Enter the value as set in your IdP configuration. See Tenant Identification Attribute. If set, this value is used to match the user with an organization. For more information, see Tenant identification and domains.
   SSO Error URL	N	If specified by your IdP provider, enter the URL where users are redirected if there is an error in the assertion process.
   IdP Logout Service Endpoint	Y	Enter the logout endpoint from your IdP provider. In Azure AD, this value is found in the Logout URL field.
   SSO Certificate	Y	Enter the certificate from your IdP server. Strip out any carriage returns and the BEGIN CERTIFICATE and END CERTIFICATE sections.
   Site Attribute	N	Enter the Site Attribute as set in your IdP configuration. See Site Attribute.
   Email Attribute	N	Enter the Email Attribute as set in your IdP configuration. See Email Attribute.
   Other Attributes	N	Expand, then specify attributes for user contact information. When these attributes are specified, FortiPortal fills in the configured fields from the SAML response when creating the account for the remote user. FortiPortal does not raise an error if any of these fields are missing or empty when users authenticate.
   Self Service Portal	N	Enter this value if provided by your IdP provider.
   Support Idp Initiated SSO	N	This should be enabled when IdP-initiated SSO is enabled on your SAML server.
   Require Response Signed from IdP	N	By default, FortiPortal requires that responses from the IdP are signed.
   Require Assertions Signed from IdP	N	By default, FortiPortal requires that assertions from the IdP are signed.
   Domains	N	Select the domains to be used for administration access. For more information about how domain matching works, see Tenant identification and domains.
   Non-Matching Domain Authentication	N	Enable or disable matching an identifying attribute that has been configured as a domain instead of the entered domain. See Tenant identification and domains.
   View/Change SSO Roles		See Mapping SSO IdP server roles user to FortiPortal profiles .

3. Click Save.

When troubleshooting single sign-on, use the following URL for the spuser account to authenticate locally, bypassing remote authentication: https://<Portal>/fpc/app/admin