Configuring the FortiGate unit

Adding a FortiAuthenticator unit as an SSO agent

On the FortiGate unit, you need to add the FortiAuthenticator unit as a Single Sign-On agent that provides user logon information.

To add a FortiAuthenticator unit as SSO agent:

1. Go to User & Device > Single Sign-On and select Create New.
2. In Type, select Fortinet Single-Sign-On Agent.
3. Enter a Name for the FortiAuthenticator unit.
4. In Primary Agent IP/Name, enter the IP address of the FortiAuthenticator unit.
5. In Password, enter the secret key that you defined for the FortiAuthenticator unit.

On the FortiAuthenticator unit, you go to Fortinet SSO Methods > SSO > General to define the secret key.

Select Enable Authentication.

6. Select OK.

In a few minutes, the FortiGate unit receives a list of user groups from the FortiAuthenticator unit. The entry in the Single Sign-On server list shows a blue caret.

When you open the server, you can see the list of groups. You can use the groups in identity-based security policies.

Configuring an FSSO user group

You cannot use FortiAuthenticator SSO user groups directly in a security policy. Create an FSSO user group and add FortiAuthenticator SSO user groups to it. FortiGate FSSO user groups are available for selection in identitybased security policies.

To create an FSSO user group:

1. Go to User & Device > User Groups and select Create New.
2. Enter a Name for the group.
3. In Type, select Fortinet Single Sign-On (FSSO).
4. Add Members.

The groups available to add as members are SSO groups provided by SSO agents.

5. Select OK.

Configuring security policies

You can create identity-based policies based on FSSO groups as you do for local user groups. For more information about security policies see the Firewall chapter.