Description
This article describes how to configure FortiAuthenticator as SAML SP to accept user identity information from Azure
Solution
This article describes how to configure FortiAuthenticator as SAML SP to accept user identity information from Azure
Solution
Most SAML IdP services will return the username in the Subject NameID assertion, group attribute and others in the assertion. Below are the samples of the SAML assertions
- FSSO requires group membership of each user with an active SSO session.
- By default groups are not enabled in the SAML Assertion.
- Always make sure or request the IdP vendor to enable that and insert groups attribute.
Different SAML IdP services require different methods of retrieving the group information.
Group information is obtained from very specific (hardcoded) SAML assertions, below is a common example of how to obtain:In Azure, group name is not send back in the assertion, an Object ID (UUID) is sent instead.Example:- The common method cannot be used to obtain the group attribute as shown above- Always request the UUID from Azure.
- Create an SSO Group on FortiAuthenticator and fill up the UUIDThe “SSO Service Provider enhancements” feature was in FortiAuthenticator v4.3.x, group attribute in now obtained from Azure then converts Azure's group membership UUIDs into names.
