External IDP Authentication

FortiPresence supports integration of third-party Identity Provider (IDP) services to log-in for data analytics. This feature is useful for enterprises that need to secure their user credentials and hence provision FortiPresence access through their own IDP website. The external IDP initiated Security Assertion Markup Language (SAML) assertion consisting of specific IDP attributes is used by FortiCloud/FortiPresence to verify the user account details and grant required access. External IDP authentication is offered in conjunction with FortiCare and FortiAuthenticator. Contact the Fortinet Customer Support team to enable external IDP support and raise an enrollment request with the appropriate FortiCare accounts.

Note: Support for SAML 2.0 and IDP initiated assertion response is required.

After successful authentication on your IDP website, you are re-directed to the FortiCloud portal from where you access FortiPresence based on the configured roles. For more information, see FortiCloud documentation.

Adding External IDP Roles

Access the Identity & Access Management (IAM) service from the FortiCloud portal

1. Navigate to Manage External IdP Roles and click Add IDP Role.
2. Enter a unique Role Name and Description (optional).
   Note: The role name must exactly match the role attribute in the SAML assertion.
   
3. Select an asset group from the Asset Permissions list.
4. Configure the Effective Portal Permissions for the required portals. Click on the edit icon against the portal and update the following.
   

   Permission	Description
   Allow Portal Access	Toggle Yes to allow access to a portal.
   Access Type	Select the Access Type that is defined by the selected portal. The allowed access types can vary for different portals.
   Additional Permisssion	Allow Additional Permission based on the selected access type. The additional permission also varies for different portals.

5. Configure the Cloud Management & Services permissions to enable access to FortiPresence. Click add (+) and select FortiPresence from the list.
6. Click the edit icon and configure the required permissions for FortiPresence.
   
   • Toggle Yes to allow access to FortiPresence.
   • Select the required Access Type, Admin or Read-Only.

   

7. Click Add Role.

After the role is created, it is listed on the on the Manage External IdP Roles page. You can enable/disable or delete a created role. Select the role and click on the required option.