1. Before you configure SSO, create one of the following authentication server configurations:
2. To use Kerberos authentication delegation, do the following:
Create a Kerberos Key Distribution Centre configuration (see Configuring a Kerberos Key Distribution Center (KDC)).
Because FortiWeb determines the KDC to use based on the realm of the web application, you do not have to specify the KDC in the site publish rule.
3. If you plan to use HTML form authentication, you can customize the HTML pages that FortiWeb presents to clients during the authentication process. See Customizing error and authentication pages (replacement messages).
4. Go to Application Delivery > Site Publish > Site Publish Rule.
5. Click Create New and configure the settings. The settings you select determine which additional settings are displayed:
Setting name | Description |
---|---|
Name |
Type a unique name that can be referenced in other parts of the configuration, such as Do not use spaces or special characters. The maximum length is 35 characters. |
Request Type |
Select one of the following options:
|
Published Site |
Enter one of the following:
The maximum length is 255 characters. Note: Regular expressions beginning with an exclamation point ( |
Path | Enter the URL of the request for the web application, such as /owa . It must begin with a forward slash ( / ). |
Client Authentication Method |
Select one of the following options:
Used when Authentication Delegation is Kerberos Constrained Delegation or No Delegation. Note: This option requires you to select a value for Certificate Verification in the server policy or Certificate Verification in the server pool configuration. |
Published Server Log Off Path |
Optionally, type the URL of the request that a client sends to log out of the application. Examples:
When clients log out of the web application, FortiWeb redirects them to its authentication dialog. Available only when Client Authentication Method is HTML Form Authentication. |
Authentication Cookie Timeout |
Specify the length of time that passes before the cookie that the site publish rule adds expires and the client must re-authenticate. Valid values are from 0 to 3600 hours. To configure the cookie with no expiration, specify |
Authentication Validation Method |
Select whether FortiWeb uses LDAP or RADIUS to authenticate clients. Available only when Client Authentication Method is HTML Form Authentication or HTML Basic Authentication. |
LDAP Server or RADIUS Server |
Select the name of the authentication query that FortiWeb uses to pass credentials to your authentication server. Available only when Client Authentication Method is HTML Form Authentication or HTML Basic Authentication. |
RSA SecurID |
Select to enable client authentication using a username and a RSA SecurID authentication code only. Users are not required to enter a password. When this option is enabled, the authentication delegation options in the site publish rule are not available. For more information, see RSA SecurID authentication. Alternatively, you can use the default two-factor authentication feature to require users to enter a username, password, and a RSA SecurID authentication code. For more information, see Two-factor authentication. Available only when Client Authentication Method is HTML Form Authentication and Authentication Validation Method is RADIUS. |
Authentication Delegation |
Select one of the following options:
To work with the Kerberos options, web applications require a specific Windows authentication configuration. See Configuring Windows Authentication for Kerberos authentication delegation. Not available when RSA SecurID is selected. |
Username Location in Certificate |
Use one of the following options to specify how FortiWeb determines the client username:
Note: Because the email value can be an alias rather than the real DC (domain controller) domain, the most reliable method for determining the username is SAN - UPN. Available only when Authentication Delegation is Kerberos Constrained Delegation. |
Delegated HTTP Service Principal Name |
Specify the Service Principal Name (SPN) for the web application that clients access using this site publish rule. A service principal name uses the following format:
For example, for an Exchange server that belongs to the domain For a FortiWeb site publishing configuration, a valid SPN requires the suffix @<domain> (for example, For instructions that include how to obtain SPN information, see To create an Active Directory (AD) user for FortiWeb. Available only when Authentication Delegation is Kerberos or Kerberos Constrained Delegation. |
Keytab File |
Select the keytab file configuration for the AD user that FortiWeb uses to obtain Kerberos service tickets for clients. To add a keytab configuration, go to Application Delivery > Site Publish > Keytab File. For instructions on how to generate the keytab file, see To create an Active Directory (AD) user for FortiWeb. Available only when Authentication Delegation is Kerberos Constrained Delegation. |
Service Principal Name for Keytab File |
Specify the Service Principal Name (SPN) of the AD user that is a delegator. It is the SPN that you used to generate the keytab specified by Keytab File. (See To create an Active Directory (AD) user for FortiWeb.) For example, For a FortiWeb site publishing configuration, a valid SPN requires the suffix @<domain> (for example, Available only when Authentication Delegation is Kerberos Constrained Delegation. |
Default Domain Prefix Support |
Select to allow users in environments that require users to log in using both a domain and username to log in with just a username. Also specify Default Domain Prefix. In some environments, the domain controller requires users to log in with the username format Alternatively, enable this option and enter Available only when Authentication Delegation is HTTP Basic or Kerberos. |
Default Domain Prefix |
Enter a domain name that FortiWeb adds to the HTTP Available only when Default Domain Prefix Support is enabled. When Authentication Delegation is Kerberos, ensure that the prefix you enter is the full domain name (for example, |
SSO Support |
Enable for single sign-on support. For example, the web site for this rule is Site publishing SSO sessions exist on FortiWeb only; they are not synchronized to the authentication or accounting server. Therefore, SSO is not shared with non-web applications. For SSO with other protocols, see the documentation for your FortiGate or other firewall. |
SSO Domain | Type the domain suffix of Host: names that can share this rule’s authentication sessions, such as .example.com . Include the period ( . ) that precedes the host’s name. |
Alert Type |
Select whether to log authentication failures, successes, or both:
Event log messages contain the user name, authentication type, success or failure, and source address (for example, |
6. Click OK.
7. Go to Application Delivery > Site Publish > Site Publish Policy.
8. Click Create New.
9. In Name, type a unique name that can be referenced in other parts of the configuration. Do not use spaces or special characters. The maximum length is 35 characters.
10. Click Create New and in Rule, select the name of a site publishing rule.
11. Repeat the previous step for each web application that is part of the SSO domain.
12. Click OK.
13. Select the site publishing policy in an inline web protection profile (see Configuring a protection profile for inline topologies). The profile must be used in the policy applying your domain’s virtual servers.
14. To verify the configuration, log in to one of the web applications, then log in to another web application in the same domain that should be part of the SSO domain.