Please note that this application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk.

This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for FortiClient / FortiGate using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization

To set up Multi-Pass with  FortiClient / FortiGate, ensure you meet the following requirements:

-  FortiClient / FortiGate admin rights

      *Fortigate v7.x.x +

      *FortiClient v7.x.x +

      *FortiClient EMS v7.x.x + (Optional)

- Configured user group ID from any IDP

- MPAS Admin rights

- Make sure that all users intended to use SSO inFortiClient / FortiGate are registered in your IdP and have the necessary permissions to access FortiClient / FortiGate.

Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.

FortiClient / FortiGate - SSO Configuration

Step 1 - Prepare FortiClient / FortiGate

In order to make this configuration easier, we advice you to open two windows, one on your Multi-Pass Dashboard and the other on FortiClient / FortiGate admin console. it will allow you to copy and paste the different fields.

Prepare Multi-Pass

• Open Multi-Pass Dashboard
  

• Go to your tenant, click on Integration then on Applications
  
• Look for the box with the Fortinet Logo
  

• We will complete the form later in the documentation but if you scroll down you can see two option that we will need in the next steps: 
  
• Tenant certificate
  
• Tenant XML data
  
• To get the metadata from MPAS, please click on "Download" under Tenant XML Data
  
• You can get it also by following this link : https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/descriptor

• You will need to provide the x.509 to FortiGate, on "tenant certificate" click on the button on the left of "Download" 
  
• Select PEM and click on download.

• Copy the x509 certificate string and save it as a .crt file in X.509 format.
  

• Upload this certificate file to FortiGate.
  

Configure FortiGate for SAML

1. In FortiGate, go to System,
   
2. Select Certificates.
   
3. Select Create/Import, choose Remote Certificate, then upload the certificate from MPAS.
4. Navigate to User & Authentication
   
5. Single Sign-On and click Create New.
   
6. Complete the form wiht the values listed below :

Field	Value
Type	Fortinet Product
Entity ID	https://ca.auth.kzero.com/tenant/<TENANT_NAME>
Assertion Consumer URL	https://ca.auth.kzero.com/tenant/<TENANT_NAME>/protocol/saml
Single Logout URL	https://ca.auth.kzero.com/tenant/<TENANT_NAME>/protocol/saml
Attribute (Username)	username
Attribute (Groups)	groups

1. You can find all this information on the form from your KZero Dashboard, copy it by clicking on the icon on the right : 
   

Configure User Group in FortiGate

1. Go to User & Authentication
   
2. Select User Groups and click Create New.
   
3. Set type to Firewall.
4. Click Add under Remote Groups.
5. Select the SAML SSO provider you created earlier.
6. Optionally specify a Group ID to restrict access.
   

VPN Configuration

1. Navigate to VPN → SSL-VPN Settings.
2. Under Authentication/Portal Mapping, click Create New.
3. Select the user group that includes your SSO provider.
   

If FortiClient is managed by EMS

• Make sure your deployment profile has these enabled in the Tunnel configuration:
• Save username
• Enable SAML login
• Use external browser as user agent for SAML login
• Redundant sort method = server
  

If FortiClient is self-managed

• Ensure the Use external browser option is selected.
  

Step 2 - Configure Integration in Multi‑Pass

1. Open Multi-Pass Dashboard
   
2. On the left side, click on Integration, and select Applications
   
3. Use the search bar to find the predefined application form

1. Complete the form with the right values based on FortiGate information :
   

Field	Value
Client ID	https://vpn.example.com/remote/saml/login
Valid Redirect URIs (Assertion Consumer Service URL)	https://vpn.example.com/remote/saml/login

1. Click on Add integration
   

Finalize Advanced Settings in Multi‑Pass

• Go to the Advanced Console and select the Client.
  

• Search for your FortiClient integration and verify:
  

Client Scopes – Mappers

1. Select the tab Client Scope
   

1. Select your client 
   
2. Create new mappers of type User Attribute:
   
1. Username

1. Groups