Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    Home FortiProxy 7.6.0 CLI Reference
    7.6.0
    7.6.0
    7.4.6
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.12
    7.2.11
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.0.19
    7.0.18
    7.0.17
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    2.0.13
    2.0.12
    2.0.0
    1.2.4

    config user saml

    config user saml

    SAML server entry configuration.

    config user saml
    Description: SAML server entry configuration.
    edit <name>
        set cert {string}
        set entity-id {string}
        set single-sign-on-url {string}
        set single-logout-url {string}
        set idp-entity-id {string}
        set idp-single-sign-on-url {string}
        set idp-single-logout-url {string}
        set idp-cert {string}
        set user-name {string}
        set group-name {string}
        set digest-method [sha1|sha256]
        set limit-relaystate [enable|disable]
        set clock-tolerance {integer}
        set adfs-claim [enable|disable]
        set user-claim-type [email|given-name|...]
        set group-claim-type [email|given-name|...]
        set reauth [enable|disable]
    next
end

    config user saml

    Parameter

    Description

    Type

    Size

    Default

    name

    SAML server entry name.

    string

    Maximum length: 35

    cert

    Certificate to sign SAML messages.

    string

    Maximum length: 35

    entity-id

    SP entity ID.

    string

    Maximum length: 255

    single-sign-on-url

    SP single sign-on URL.

    string

    Maximum length: 255

    single-logout-url

    SP single logout URL.

    string

    Maximum length: 255

    idp-entity-id

    IDP entity ID.

    string

    Maximum length: 255

    idp-single-sign-on-url

    IDP single sign-on URL.

    string

    Maximum length: 255

    idp-single-logout-url

    IDP single logout url.

    string

    Maximum length: 255

    idp-cert

    IDP Certificate name.

    string

    Maximum length: 35

    user-name

    User name in assertion statement.

    string

    Maximum length: 255

    group-name

    Group name in assertion statement.

    string

    Maximum length: 255

    digest-method

    Digest method algorithm.

    option

    -

    sha1

    Option

    Description

    sha1

    Digest Method Algorithm is SHA1.

    sha256

    Digest Method Algorithm is SHA256.

    limit-relaystate

    Enable/disable limiting of relay-state parameter when it exceeds SAML 2.0 specification limits (80 bytes).

    option

    -

    disable

    Option

    Description

    enable

    Enable limiting of relay-state parameter when it exceeds SAML 2.0 specification limits (80 bytes).

    disable

    Disable limiting of relay-state parameter when it exceeds SAML 2.0 specification limits (80 bytes).

    clock-tolerance

    Clock skew tolerance in seconds.

    integer

    Minimum value: 0 Maximum value: 300

    15

    adfs-claim

    Enable/disable ADFS Claim for user/group attribute in assertion statement.

    option

    -

    disable

    Option

    Description

    enable

    Enable ADFS Claim for user/group attribute in assertion statement.

    disable

    Disable ADFS Claim for user/group attribute in assertion statement.

    user-claim-type

    User name claim in assertion statement.

    option

    -

    upn

    Option

    Description

    email

    E-mail address of the user.

    given-name

    Given name of the user.

    name

    Unique name of the user.

    upn

    User principal name (UPN) of the user.

    common-name

    Common name of the user.

    email-adfs-1x

    E-mail address of the user when interoperating with AD FS 1.1 or ADFS 1.0.

    group

    Group that the user is a member of.

    upn-adfs-1x

    User principal name (UPN) of the user.

    role

    Role that the user has.

    sur-name

    Surname of the user

    ppid

    Private identifier of the user.

    name-identifier

    SAML name identifier of the user.

    authentication-method

    Method used to authenticate the user.

    deny-only-group-sid

    Deny-only group SID of the user.

    deny-only-primary-sid

    Deny-only primary SID of the user.

    deny-only-primary-group-sid

    Deny-only primary group SID of the user.

    group-sid

    Group SID of the user.

    primary-group-sid

    Primary group SID of the user.

    primary-sid

    Primary SID of the user.

    windows-account-name

    Domain account name of the user in the form of <domain>\<user>.

    group-claim-type

    Group claim in assertion statement.

    option

    -

    group

    Option

    Description

    email

    E-mail address of the user.

    given-name

    Given name of the user.

    name

    Unique name of the user.

    upn

    User principal name (UPN) of the user.

    common-name

    Common name of the user.

    email-adfs-1x

    E-mail address of the user when interoperating with AD FS 1.1 or ADFS 1.0.

    group

    Group that the user is a member of.

    upn-adfs-1x

    User principal name (UPN) of the user.

    role

    Role that the user has.

    sur-name

    Surname of the user

    ppid

    Private identifier of the user.

    name-identifier

    SAML name identifier of the user.

    authentication-method

    Method used to authenticate the user.

    deny-only-group-sid

    Deny-only group SID of the user.

    deny-only-primary-sid

    Deny-only primary SID of the user.

    deny-only-primary-group-sid

    Deny-only primary group SID of the user.

    group-sid

    Group SID of the user.

    primary-group-sid

    Primary group SID of the user.

    primary-sid

    Primary SID of the user.

    windows-account-name

    Domain account name of the user in the form of <domain>\<user>.

    reauth

    Enable/disable signalling of IDP to force user re-authentication.

    option

    -

    disable

    Option

    Description

    enable

    Enable signalling of IDP to force user re-authentication.

    disable

    Disable signalling of IDP to force user re-authentication.
    Previous
    Next

    config user saml

    config user saml

    SAML server entry configuration.

    config user saml
    Description: SAML server entry configuration.
    edit <name>
        set cert {string}
        set entity-id {string}
        set single-sign-on-url {string}
        set single-logout-url {string}
        set idp-entity-id {string}
        set idp-single-sign-on-url {string}
        set idp-single-logout-url {string}
        set idp-cert {string}
        set user-name {string}
        set group-name {string}
        set digest-method [sha1|sha256]
        set limit-relaystate [enable|disable]
        set clock-tolerance {integer}
        set adfs-claim [enable|disable]
        set user-claim-type [email|given-name|...]
        set group-claim-type [email|given-name|...]
        set reauth [enable|disable]
    next
end

    config user saml

    Parameter

    Description

    Type

    Size

    Default

    name

    SAML server entry name.

    string

    Maximum length: 35

    cert

    Certificate to sign SAML messages.

    string

    Maximum length: 35

    entity-id

    SP entity ID.

    string

    Maximum length: 255

    single-sign-on-url

    SP single sign-on URL.

    string

    Maximum length: 255

    single-logout-url

    SP single logout URL.

    string

    Maximum length: 255

    idp-entity-id

    IDP entity ID.

    string

    Maximum length: 255

    idp-single-sign-on-url

    IDP single sign-on URL.

    string

    Maximum length: 255

    idp-single-logout-url

    IDP single logout url.

    string

    Maximum length: 255

    idp-cert

    IDP Certificate name.

    string

    Maximum length: 35

    user-name

    User name in assertion statement.

    string

    Maximum length: 255

    group-name

    Group name in assertion statement.

    string

    Maximum length: 255

    digest-method

    Digest method algorithm.

    option

    -

    sha1

    Option

    Description

    sha1

    Digest Method Algorithm is SHA1.

    sha256

    Digest Method Algorithm is SHA256.

    limit-relaystate

    Enable/disable limiting of relay-state parameter when it exceeds SAML 2.0 specification limits (80 bytes).

    option

    -

    disable

    Option

    Description

    enable

    Enable limiting of relay-state parameter when it exceeds SAML 2.0 specification limits (80 bytes).

    disable

    Disable limiting of relay-state parameter when it exceeds SAML 2.0 specification limits (80 bytes).

    clock-tolerance

    Clock skew tolerance in seconds.

    integer

    Minimum value: 0 Maximum value: 300

    15

    adfs-claim

    Enable/disable ADFS Claim for user/group attribute in assertion statement.

    option

    -

    disable

    Option

    Description

    enable

    Enable ADFS Claim for user/group attribute in assertion statement.

    disable

    Disable ADFS Claim for user/group attribute in assertion statement.

    user-claim-type

    User name claim in assertion statement.

    option

    -

    upn

    Option

    Description

    email

    E-mail address of the user.

    given-name

    Given name of the user.

    name

    Unique name of the user.

    upn

    User principal name (UPN) of the user.

    common-name

    Common name of the user.

    email-adfs-1x

    E-mail address of the user when interoperating with AD FS 1.1 or ADFS 1.0.

    group

    Group that the user is a member of.

    upn-adfs-1x

    User principal name (UPN) of the user.

    role

    Role that the user has.

    sur-name

    Surname of the user

    ppid

    Private identifier of the user.

    name-identifier

    SAML name identifier of the user.

    authentication-method

    Method used to authenticate the user.

    deny-only-group-sid

    Deny-only group SID of the user.

    deny-only-primary-sid

    Deny-only primary SID of the user.

    deny-only-primary-group-sid

    Deny-only primary group SID of the user.

    group-sid

    Group SID of the user.

    primary-group-sid

    Primary group SID of the user.

    primary-sid

    Primary SID of the user.

    windows-account-name

    Domain account name of the user in the form of <domain>\<user>.

    group-claim-type

    Group claim in assertion statement.

    option

    -

    group

    Option

    Description

    email

    E-mail address of the user.

    given-name

    Given name of the user.

    name

    Unique name of the user.

    upn

    User principal name (UPN) of the user.

    common-name

    Common name of the user.

    email-adfs-1x

    E-mail address of the user when interoperating with AD FS 1.1 or ADFS 1.0.

    group

    Group that the user is a member of.

    upn-adfs-1x

    User principal name (UPN) of the user.

    role

    Role that the user has.

    sur-name

    Surname of the user

    ppid

    Private identifier of the user.

    name-identifier

    SAML name identifier of the user.

    authentication-method

    Method used to authenticate the user.

    deny-only-group-sid

    Deny-only group SID of the user.

    deny-only-primary-sid

    Deny-only primary SID of the user.

    deny-only-primary-group-sid

    Deny-only primary group SID of the user.

    group-sid

    Group SID of the user.

    primary-group-sid

    Primary group SID of the user.

    primary-sid

    Primary SID of the user.

    windows-account-name

    Domain account name of the user in the form of <domain>\<user>.

    reauth

    Enable/disable signalling of IDP to force user re-authentication.

    option

    -

    disable

    Option

    Description

    enable

    Enable signalling of IDP to force user re-authentication.

    disable

    Disable signalling of IDP to force user re-authentication.
    Previous
    Next