Preparation

Configure the port on which FortiGate receives SAML authentication.
Open the CLI console by clicking the ">_" icon in the upper right of the FortiGate admin screen, and run the command.
Note: Please configure this according to your environment. For details, see here.

As an example, the following command is run here.

config system global
set auth-ike-saml-port 9443
end

TrustLogin Admin Page Configuration

1. Log in to TrustLogin, open the "Admin Page > Apps" menu, and click the "Register App" button in the upper right of the screen.
   
   
2. Search on the "Register Corporate App" screen and select "FortiGate (SAML)".
   
   
3. Make a note of the "IdP URL" and "Issuer/Entity ID" under "Identity Provider Information", and download the certificate from "Get Certificate".
   Note: Change the extension of the downloaded certificate to ".cert".
   
   
4. In the three blank fields under "Service Provider Settings", enter the IP (or FQDN) to be connected to and the port used for SAML authentication (the port configured in Preparation) in the format "[IP]:[Port]".
   
   
5. Click the "Register" button to save.

FortiGate Configuration

1. Register the TrustLogin certificate on FortiGate.
   Open the FortiGate admin screen and upload the certificate downloaded from TrustLogin via "System > Certificates > Create/Import > Remote". Make a note of the "Name" of the registered certificate.
   
   
   
   
   
   
2. Configure SAML authentication.
   Open "User & Authentication > Single Sign-On > Create New".
   
   

3. Configure as follows and click "Next".

   Name	Any name
   Address	Enter the IP (or FQDN) to be connected to and the port used for SAML authentication in the format "[IP]:[Port]"
   Certificate	Enable the toggle and select "Fortinet_Factory"

   
   

4. Configure as follows and click "Submit".

   Type	Select "Custom"
   Entity ID	The "Issuer/Entity ID" obtained from TrustLogin
   Assertion Consumer Service URL	The "IdP URL" obtained from TrustLogin
   Certificate	Select the certificate registered in step "1"
   Attribute used to identify the user	username

   
   

5. Create a user group that will use SAML authentication.
   Open "User & Authentication > User Groups > Create New".
   
   

6. Configure as follows and click "OK".

   Name	Any name
   Type	Select "Firewall"
   Remote Groups	From "Add > Remote Server", select the SAML configuration created in step "4"

   
   

7. Configure the IPsec VPN tunnel to connect via SAML authentication.
   Open "VPN > IPsec Wizard", configure "①VPN Setup" as follows, and click "Next".

   Name	Any name
   Template Type	Remote Access
   Remote Device Type	Configure according to your environment (here, "Client-based/FortiClient" is selected)

   
   

8. Configure "②Authentication" as follows and click "Next".

   Incoming Interface	Configure according to your environment (here, "WAN" is selected)
   Authentication Method	Select "Pre-shared Key"
   Pre-shared Key	Any value Note: This will be used when connecting via VPN with FortiClient, so make a note of it.
   User Group	Select the user group created in step "6"

   
   

9. Configure "③Policy & Routing" and "④Client Options" according to your environment, proceed to "⑤Review Settings" to confirm the details, and click "Create".
   
   
10. From "VPN > IPsec Tunnels", select the tunnel created in steps "7" through "9" and click "Edit".
    
    
11. Click "Convert To Custom Tunnel".
    
    
12. Under "Authentication" > "IKE", select version "2".
    
    
13. Configure "Phase 1 Proposal" according to your environment. After configuring, make a note of the "Diffie-Hellman Group" setting value.
    Note: The FortiClient settings on the device connecting to the VPN must match the value set here for "Diffie-Hellman Group".
    
    
14. Configure according to your environment under "Phase 2 Selectors > Advanced". After configuring, make a note of the "Diffie-Hellman Group" setting value.
    Note: The FortiClient settings on the device connecting to the VPN must match the value set here for "Diffie-Hellman Group".
    
    After configuring, click "OK".
    
    

15. Configure the interface that will accept SAML authentication.
    Open the FortiGate CLI console and run the following commands.

    config vpn ipsec phase1-interface
      edit "TrustloginVPN"　　←※The tunnel name created in step "14"
       set ike-version 2
       set eap enable
       set eap-identity send-request
       set authusrgrp "VPN_SAML_Group"　　←※The user group name created in step "6"
      next
    end

16. Link the interface that accepts SAML authentication with the single sign-on configuration to be used.
    Open the FortiGate CLI console and run the following commands.

    config system interface
      edit "wan"　　←※The incoming interface configured in step "8"
        set ike-saml-server "Trustlogin"　　←※The single sign-on configuration name created in step "4"
      next
    end

    

This completes the configuration on the FortiGate side.

TrustLogin User Configuration

① When a User Adds via My Page

Note: The SAML app must be configured in advance by the administrator.

1. On "My Page", click the "Add App" button.
2. On the "Register App" screen, select "FortiGate (SAML)" and click the "Next" button in the upper right of the screen.
3. To change the "Display Name", enter a new value, then click the "Register" button.

② When an Administrator Adds Members

1. In the "Admin Page > Apps" menu, search for the "FortiGate (SAML)" app and click it.
2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.
   

How to Use FortiClient VPN (PC)

1. Open FortiClient VPN and configure a new VPN connection via "Add a new connection" as follows.

   Connection Name	Any name
   Remote Gateway	The IP to be connected to
   Authentication Method	Select "Pre-shared key" / the pre-shared key value configured in step "8" of "FortiGate Configuration"
   Single Sign On Setting	Check "Enable Single Sign On (SSO) for VPN Tunnel"
   Edit Port	The port used for SAML authentication configured in "Preparation"
   Use External Browser as User-Agent for SAML user authentication	Check the box

   
   
   
   
   

2. Open "Advanced Settings", configure as follows, and click "Save".

   Advanced Settings > VPN Settings
   IKE	Version 2
   Address Assingnment	Mode Config
   Encapsulation	IKE UDP Port (Port: 500)
   Advanced Settings > Phase1
   DH Group	Same value as the "Diffie-Hellman Group" configured in step "13" of "FortiGate Configuration"
   Advanced Settings > Phase2
   DH Group	Same value as the "Diffie-Hellman Group" configured in step "14" of "FortiGate Configuration"

   
   
   
   

3. Click "Connect" to open a browser and prompt for TrustLogin authentication.
   After logging in on the TrustLogin side, SAML authentication for FortiClient VPN begins, and once successful, the FortiClient VPN connection is established.
   

How to Use FortiClient VPN (iOS - Native App)

1. Open FortiClient VPN and tap "Select connection > Add Configuration".
   
   

2. Configure as follows and tap "Save".

   VPN ACCOUNT INFORMATION
   Secure Protocol	IKEv2 VPN
   Name	Any name
   Server Address	The IP to be connected to
   SSO	Turn the toggle ON
   Port	The port used for SAML authentication configured in "Preparation"
   ADVANCED SETTINGS
   Authentication Method	Pre-shared key
   Pre-shared Key Secret	The pre-shared key value configured in step "8" of "FortiGate Configuration"
   EAP-Auth	Turn the toggle ON
   PHASE 1
   DH Group	Same value as the "Diffie-Hellman Group" configured in step "13" of "FortiGate Configuration"
   PHASE 2
   DH Group	Same value as the "Diffie-Hellman Group" configured in step "14" of "FortiGate Configuration"

   
   

3. From "USER VPN GATEWAY", tap the created VPN configuration to check it.
   
   
4. Tap "VPN" to return to the initial screen, and turn the "Connect" toggle ON.
   
   
5. You will be taken to the TrustLogin login screen.
   After logging in on the TrustLogin side, SAML authentication for FortiClient VPN begins, and once successful, the FortiClient VPN connection is established.