Fortinet VPN configuring Duo for multiple tenants

[mhoude]

Hi,

We have a Fortigate unit where the VPN users are splitted between two Azure tenants.  We can configure the MFA using this procedure: Technical Tip: SSL VPN with SAML authentication wi... - Fortinet Community.

However we are looking to buy Duo licenses and are wondering if it supports such scenario ?

Thanks

[DuoKristina]

It seems like the configuration is all on the Fortigate and which SAML IdP you use with it is immaterial.

The only thing though is that this named Fortigate Duo SSO application https://duo.com/docs/sso-fortinet-fortigate doesn't support sending group info in the SAML assertion.

This Fortigate article, which describes SAML SSO using a Duo SSO Generic SAML application, does include group mapping, which is also mentioned in the article you linked. https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-SAML-SSL-VPN-using-DUO-as-the/ta-p/217433

I don't know how you plan to buy Duo licenses, if direct from duo.com or via a Cisco reseller, but you can always sign up for a free 30-day Duo trial at https://signup.duo.com/ to test this config before you buy.