Note: Prior configuration on FortiGate is required.
Note: For the latest configuration steps, please refer to the manual provided by FortiGate. (We have verified this procedure using FortiOS v7.0.1 build0157 (GA).)

TrustLogin Admin Page Settings

1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register App" button at the top right of the screen.
   
   
   
2. On the "Register Company App" screen, search for and select "FortiGate (SAML) ".
   
   
   
3. Note the "IdP URL" and "Issuer/Entity ID" under "Identity Provider Information", and download the certificate from "Get Certificate".
   The certificate is provided as a .txt file, so change the file extension to ".cert".
   
   
   
4. In the three blank fields under "Service Provider Settings", enter the IP address and port of the connection target in the format "[IP]:[Port]".
   
   
   
5. Save the configuration by clicking the "Register" button.

FortiGate Configuration

1. Open the FortiGate admin console and, from "System > Certificates > Import > Remote", upload the certificate downloaded from TrustLogin.
   Please make a note of the certificate file name.
   
   
   
   
   

2. From the FortiGate console, create a SAML user.
   Use the "IdP URL" and "Issuer/Entity ID" noted from TrustLogin, and the "certificate name" from when it was uploaded to FortiGate.
   
   Normally, to create a local user, you would create it under config user local from the GUI; however, in the case of SAML, since FortiGate does not create an internal database, you need to write the settings required for SSO into user saml using the CLI.
   
   
   

3. Create a group from the FortiGate console and link it to the user created in step 2.
   
   
   

4. Configure the SSL-VPN settings.
   

   Listening Interface	port1	Configure as needed
   Listening Port	4443	Configure as needed; this manual uses 4443
   Server Certificate	Fortinet_Factory	Configure as needed
   Authentication / Portal Mapping	tl-saml-group	User group created via CLI

   
   
   
   

5. Configure the firewall policy.

   Incoming Interface	SSL-VPN tunnel interface (ssl.root)
   Outgoing Interface	port1	Configure as needed
   Source (source)	tl-saml-group	User group created via CLI
   Destination	all
   Schedule	always
   Service	ALL

   
   
   
   

TrustLogin User Settings

① When a User Adds the App via My Page

1. Click the "Add App" button on "My Page".
2. On the "Register App" screen, select "FortiGate (SAML) " and click the "Next" button at the top right of the screen.
3. If you want to change the "Display Name", enter it, then click the "Register" button.

② When an Administrator Adds Members

1. Search for and click the "FortiGate (SAML) " app in the "Admin Page > App" menu.
2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.

Connection Settings

Windows Settings

1. In IE Internet Options, under the "Security" tab, add the FortiGate server's IP address to "Trusted sites".
   
   
   
   

2. In IE Internet Options, under the "Advanced" tab, uncheck "Use TLS 1.0" and save.
   

FortiClient VPN Usage

This example uses the latest version of the FortiClient Windows edition.
https://www.fortinet.com/support/product-downloads#vpn

1. In the new VPN connection, enter the IP address and port of the connection target, and enable SSO and authentication via an external browser.
   
   
   

2. When you click the "SAML Login" button, a browser window opens and prompts you to authenticate with TrustLogin. After logging in on the TrustLogin side, FortiClient VPN SAML authentication begins, and once it succeeds, the FortiClient VPN connection is established.