User Guide

How to setup FortiAuthenticator in Keycloak with OIDC

This guide explains how to configure FortiAuthenticator (6.6.2) as an Identity Provider (IdP) in Keycloak.

Note

This guide assumes that you have access to the Authentication Admin Console and to your FortiAuthenticator console.

Note

You need the discovery info endpoint URL from your FortiAuthenticator instance. This URL is used to configure the IdP auto-discovery in Keycloak. Following this guide the URL should be https://<FORTIAUTHENTICATOR_HOST>/api/v1/oauth/.well-known/openid-configuration/.

Client and Keycloak Configuration

To configure FortiAuthenticator as an IdP in Keycloak, you need to go to the Authentication Admin Console and follow these steps:

  • Go to Identity Providers > Add provider > OpenID Connect v1.0.

  • Select an alias for the IdP, for example, Fortinet and copy the redirect URL.

  • Open a new page and go to your FortiAuthenticator console.

Next, we need to create a new OIDC client in FortiAuthenticator, you can follow this guide to create a new client. Feel free to configure the settings as needed, however, it is recommended to use the following parameters:

Field

Value

Client type

confidential

Authorization grant types

Authorization Code

Scopes

openid. You can read this guide to create scopes

Claims

With openid you need to add at least one claim: the username. You can read this guide to create claims

Redirect URIs

The redirect URL from Keycloak

Note

Other parameters have to be configured depending on your own setup.

Now you can copy the client id and the secret, and put them in the Keycloak configuration. After that, simply click on Save.

Next step is adding a new mapper in Mappers with the following settings:

  • Name: username

  • Mapper Type: Attribute Importer

  • Attribute Name: **username**

  • User Attribute Name: username

Note

The Attribute Name MAY be different for you, refer to your claim names to make sure. In this configuration we used username.

At this point, you can complete the rest of the configuration with common settings, please refer to Common IdP configuration and IdP After Setting up configuration sections to find all the information you need.