profile sso
Use this command to configure connections with remote authentication servers such as FortiAuthenticator that support single sign-on (SSO) protocols.
In Security Assertion Markup Language (SAML) SSO, you must configure both of these to connect and authenticate with each other:
- FortiMail, which is the service provider (SP). See system saml.
- FortiAuthenticator or other remote authentication server, which is the identity provider (IdP)
To do this, you must:
-
On the IdP server:
-
Download its IdP metadata XML.
Alternatively, copy the URL where FortiMail can download it.
-
The email address that the user must give when they authenticate is stored in an attribute on the IdP server. This attribute has an object identifier (OID). If this OID is different than the default setting of remote-user-attribute-name "<attribute_str>" on FortiMail, then copy the IdP server's OID. For example:
-
urn:oid:0.9.2342.19200300.100.1.3
-
-
On FortiMail:
-
If you are integrating with FortiAuthenticator or Ping Identity, then on FortiMail, use the CLI to enable Security Fabric and the administrator account named
admin_sso:config system csf
set status enable
end
config system admin
edit admin_sso
set status enable
end
The
admin_ssoaccount acts as a wildcard, so that you do not need to configure all FortiMail accounts on the IdP too. The Security Fabric provides communication for this feature. -
Paste the IdP metadata XML into an SSO profile. If the IdP uses a different attribute OID than the FortiMail default, then also configure that.
See idp-metadata <idp-xml_str> and remote-user-attribute-name "<attribute_str>".
Now FortiMail automatically generates its SP metadata, entity ID, and ACS URL. (You might need to navigate away from the tab and return in order for it to display.)
-
Enable SSO. Copy the SP entity ID, ACS URL, and metadata XML.
See system saml.
-
-
On the IdP server:
- Paste the entity ID, SP metadata URL, and ACS URL from FortiMail.
-
Select to identify users by their email addresses attribute, and then enter the attribute object identifier (OID) that authentication requests from FortiMail use:
urn:oid:0.9.2342.19200300.100.1.3 - Optionally, enable and configure multi-factor authentication (MFA).
-
If required, add the FortiMail unit's certificate to the list of trusted CAs ("trust store").
(Skip this step if your IdP already trusts the certificate, directly or indirectly, via a CA certificate signing chain.)
-
On FortiMail, for each account that will use SAML SSO to log in, configure:
- auth-strategy {cloud | ldap | local | pki | radius | sso} and sso-profile <profile_name> (administrator accounts)
- sso-status {enable | disable} and sso-profile <profile_name> (protected domain users)
In addition to SSO, FortiMail also supports single log off (SLO). When someone logs out of FortiMail, they will also be logged out of all services that use the same federated SSO authentication.
Syntax
config profile sso
edit <profile_name>
set remote-user-attribute-name "<attribute_str>"
set idp-metadata <idp-xml_str>
end
|
Variable |
Description |
Default |
|
Enter a unique name for the profile. |
|
|
|
Enter a descriptive comment. |
|
|
|
Enter the XML metadata that contains the X.509 server certificate, supported protocols, and service URLs of the identity provider (IdP). |
|
|
|
Enter the object identifier (OID) of email addresses on the IdP server. If you do not enter an OID, then FortiMail uses the default OID |
|