FPX222 # sh authentication rule saml-auth

config authentication rule

edit "saml-auth"

set srcintf "any"

set srcaddr "all"

set dstaddr "all"

set active-auth-method "saml"

next

end

Step 6: Configure authentication settings

To configure authentication settings from the GUI:

1. Select Policy & Objects > Proxy Auth Setting.

   

To configure authentication settings from the CLI:

FPX222 # sh authentication setting

config authentication setting

set active-auth-scheme "saml"

set captive-portal "fpx222.domain.local"

end

Step 7: Configure a user group

To configure a user group from the GUI:

1. Select User & Authentication > User Groups.

   

To configure a user group from the CLI:

config user group

edit "saml_grp"

set member "wadtest"

config match

edit 1

set server-name "wadtest"

set group-name "saml_grp"

next

end

next

end

Step 8: Configure a firewall policy

config firewall policy

edit 18

set type explicit-web

set name "SAML- ADFS _Access"

set uuid ceacefd8-4392-51ee-7278-44d09ef3bcd0

set dstintf "any"

set srcaddr "all"

set dstaddr "FPXQA.FPXLAB.local"

set action accept

set schedule "always"

set service "webproxy"

set explicit-web-proxy "web-proxy"

set log-http-transaction all

next

edit 16

set type explicit-web

set name "SAML_auth"

set uuid 8d2050cc-4389-51ee-b9bd-d28c45e0827d

set dstintf "any"

set srcaddr "all"

set dstaddr "all"

set action accept

set schedule "always"

set service "webproxy"

set explicit-web-proxy "web-proxy"

set groups "saml_grp"

set ssl-ssh-profile "deep-inspection"

next

end

Microsoft ADFS configuration

To configure SAML authentication with Microsoft ADFS, you must create a relying party trust, edit the Claim Issuance so that ADFS transfers the Name ID and Name attribute assertion in the SAML response, and upload the FortiProxy SAML SP certificate to the relying party. The example below uses Windows Server 2016.

1. In AD FS Manager, right-click Relying Party Trust and select Add Relying Party Trust.

   

2. On the Welcome page, select Claims aware and click Start.

   

3. On the Select Data Source page, select Enter data about the relying party manually and click Next.

   

4. On the Specify Display Name page, type a name in Display name, under Notes type a description for this relying party trust, and then click Next.

   

5. On the Configure Certificate page, click Next to skip the configuration.

   

6. On the Configure URL page, select Enable support for the SAML 2.0 Web SSO protocol and enter the single sign on URL that you configured in Step 3: Configure SAML above. Click Next.

   

7. On the Configure Identifiers page, enter the entity ID that you configured in Step 3: Configure SAML above, click Add, and then click Next.

   

8. On the Choose Access Control Policy page, select a policy and click Next. For more information about Access Control Policies, see Access Control Policies in AD FS.

9. On the Ready to Add Trust page, review the settings and click Next to save your relying party trust information.

10. On the Finish page, click Close. This action automatically displays the Edit Claim Rules dialog box. Click Add Rule.

11. Enter the Claim rule name, select Active Directory under Attribute store, add mapping of LDAP attributes for Name and Name ID, and click OK.

    

12. In the Relying Party Trusts list, select the relying party trust you just created and click Properties on the right pane.

13. In the Advanced tab, select the correct secure hash algorithm. In this example, we select SHA-256 which is the algorithm we configured in Step 3: Configure SAML above.

    

14. In the Signature tab, click Add to upload the FortiProxy SAML SP certificate to the relying party and click OK. Use the certificate that you configured in Step 3: Configure SAML above. You must first download the certificate from the FortiProxy Certificate list.