Skip to main content

Integrate with FortiManager

Support level: Community

What is FortiManager​

FortiManager supports network operations use cases for centralized management, best practices compliance, and workflow automation to provide better protection against breaches.

FortiManager is a paid enterprise product.

-- https://www.fortinet.com/products/management/fortimanager

Preparation​

The following placeholders are used in this guide:

  • fgm.company is the FQDN of the FortiManager installation.
  • authentik.company is the FQDN of the authentik installation.
note

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

Create an application and Provider in authentik, note the slug, as this will be used later. Create a SAML provider with the following parameters:

Provider:

  • ACS URL: https://fgm.company/saml/?acs
  • Issuer: https://authentik.company/application/saml/fgm/sso/binding/redirect/
  • Service Provider Binding: Post

You can of course use a custom signing certificate, and adjust durations.

Application:

FortiManager Configuration​

Navigate to https://fgm.company/p/app/#!/sys/sso_settings and select SAML SSO settings to configure SAML.

Select 'Service Provider (SP)' under Single Sign-On Mode to enable SAML authentication.

Set the Field 'SP Address' to the FortiManager FQDN 'fgm.company'. (This gives you the URLs to configure in authentik)

Set the Default Login Page to either 'Normal' or 'Single-Sign On'. (Normal allows both local and SAML authentication vs only SAML SSO)

FortiManager create a new user by default if one does not exist so you will need to set the Default Admin Profile to the permissions you want any new users to have. (We created a no_permissions profile to assign by default)

Set the Field 'IdP Type' to 'Custom'

Set the Field IdP entity ID to https://authentik.company/application/saml/fgm/sso/binding/redirect/.

Set the Field IdP Login URL to https://authentik.company/application/saml/fgm/sso/binding/redirect/.

Set the Field IdP Logout URL to https://authentik.company/

For the Field 'IdP Certificate" Import your authentik cert. (Self Signed or real)