How to configure FortiClient SSL VPN SSO with Azure AD

How to configure FortiClient SSL VPN SSO with Azure AD. In this comprehensive blog post, we’ll explore two crucial steps: First, we’ll delve into setting up Azure Enterprise Application, providing you with a solid foundation. Then, we’ll guide you through the intricate process of implementing Single Sign-On (SSO) on FortiGate, ensuring a seamless and secure user authentication experience. By the end of this tutorial, you’ll have a robust, integrated VPN solution, empowering your organization with top-notch cybersecurity. Let’s dive in and fortify your network defenses!

What are we going to set up?

In the first step, we will create a new enterprise application in Entra/Azure. During this process, we will directly configure important parameters for SAML sign-in. In the second step, we will configure Single Sign-On (SSO) on the FortiGate. In the third step, we will create a group in Azure Active Directory (AAD) and add it to the FortiGate. This allows us to use the group from AAD directly in the policies on the FortiGate. In the final step, we will add a new user.

Setup Azure Enterprise Application

We first need to create an Enterprise Application for the FortiClient SSL VPN SSO. Follow these steps:

• Navigate to https://entra.microsoft.com/
• Click on Identity
• Click on Applications
• Click on Enterprise applications
• Click on New application

• Search for FortiGate
• Click on the FortiGate SSL VPN application
• Click on Create

• The application will be added. This can take a minute.
• Click on the newly generated application FortiGate SSL VPN

• Click on Single sign-on
• Click on SAML

• Click on Edit on the Basic SAML Configuration

In the SAML setting we need to define the following settings. Just modify the Green Parts from the URL below:

• Identifier (Entity ID):
  • https://<FortiGate IP or FQDN address>:<Custom SSL VPN port>/remote/saml/metadata

• Reply URL (Assertion Consumer Service URL)

  • https://<FortiGate IP or FQDN address>:<Custom SSL VPN port>/remote/saml/login
• Sign on URL
  • https://<FortiGate IP or FQDN address>:<Custom SSL VPN port>/remote/saml/login
• Logout Url (Optional)
  • https://<FortiGate IP or FQDN address>:<Custom SSL VPN port><FQDN>/remote/saml/logout

In the picture i used the fortigate.fortiddns.com FQDN and an custom Port 10443.

• Click on Save

• Click on Edit from the Attributes & Claims
• Click on Add new claim

• In Name enter username
• In Source attribute enter user.userprincipalname
• Click on Save

• Click on Add a group claim
• Click on All groups
• In the Advanced options tick the Customize the name of the group claim
• In the Name enter group

• Go back to the application Single sign-on
• On the SAML Certificates Download the Certificate (Base64). We need this file in step 2.
• The Login URL / Microsoft Entra ID Identifier and Logout URL we need in step 2.

Setup SSO on FortiGate

First we are going to upload the Base64 SAML certificate to the FortiGate.

• Connect and Login to the FortiGate Management Interface
• Navigate to System
• Under System, select Certificates
• Select Import > Remote Certificate

• Click on Upload
• Browse to the Base64 certificate downloaded from the FortiGate app deployment in the Azure tenant, select it, and then select OK

• Go check on the Certificates page. There should be a new Certificate under Remote Certificate. Note down the name of the Certificate. By default, it will be named REMOTE_Cert_N, where N is an integer value.

Although you can configure SSO from the GUI since FortiOS 7.0, the CLI configurations apply to all versions and are therefore shown here.

• On the GUI click on the CLI Console

See the command below. We just need to fill out the right Information of the Green text. For every Red number there is a short descriptions where you can find the Information.

Just enter the Command one by one.

config user saml
edit azure
set cert <FortiGate VPN Server Certificate Name [1]>
set entity-id <Identifier (Entity ID)Entity ID [2]>
set single-sign-on-url <Reply URL Reply URL [3]>                
set single-logout-url <Logout URL [4]>
set idp-entity-id <Azure AD Identifier [5]>
set idp-single-sign-on-url <Azure Login URL [6]>  
set idp-single-logout-url <Azure Logout URL [7]> 
set idp-cert <Base64 SAML Certificate Name [8]> 
set user-name username
set group-name group
next
end

Congratulations! You have finished with the FortiGate SSO Setup. Now go to Step 3

Setup FortiGate group matching

• Group type Security
• Group name FortiGateAccess
• Click on Create

• Click on the newly created Security Group FortiGateAccess
• Go to the Overview page and copy the Object id. We need this in the next step.

Now we are going to integrate the security group in to the FortiGate.

• Connect to the FortiGate management interface
• Open the CLI Console
• Enter the following Command. In the green spot enter the copied Object Id of the security group.

config user group
edit FortiGateAccess
set member azure
config match
edit 1
set server-name azure
set group-name <Object Id [1]>
next
end
next
end

Use this group to allow users to connect to the Forticlient. Add this group to your SSL-VPN settings and to your firewall policy if applicable.

Add User

To add a user you need to add them to the FortiGateAccess security group and as member in the FortiGate SSL VPN enterprise application.

The setup of the Forticlient SSO is now finished. Users can now use their Microsoft Account for logging in to their Forticlient connection.