FortiPAM Integration with Fortinet IAM Solutions | Products

### Overview In this demonstration, Jannar Garcia, Technical Marketing Engineer at Fortinet, presents an identity and access management (IAM) architecture integrating FortiPAM (privileged access management), FortiAuthenticator Cloud, and FortiIdentity Cloud. The solution addresses challenges faced by enterprises of any size and MSSPs—especially during mergers and acquisitions—when unifying disparate identity providers and managing access for diverse user categories, such as contractors and employees.

### Key Topics - **Role-Tailored Dashboards**: Providing streamlined dashboards with pre-selected targets for contractors and robust, feature-rich dashboards for full employees. - **Unified Identity Federation**: Integrating FortiPAM with FortiAuthenticator Cloud to support third-party IdPs such as Entra ID, Okta, Active Directory, or local authentication. - **Multi-Factor Authentication (MFA)**: Leveraging FortiIdentity Cloud to enforce MFA via mobile push notifications (FortiToken Mobile) or email verification to mitigate phishing and credential compromise. - **Access Control & Segmentation**: Using direct connections for internal users and ZTNA (referred to in transcript as CTNA/C10A) tagging controls for remote endpoints. - **Auditing and Session Recording**: Capturing granular logs, recording user sessions, tracking commands entered, and generating access and launcher reports.

### Technical Details - **Authentication Workflow**: When users authenticate to FortiPAM, FortiAuthenticator Cloud validates credentials against a remote user database via RADIUS or SAML. FortiIdentity Cloud subsequently enforces MFA. - **Configuration & Launchers**: Remote users (such as `Carl at octa.com` and `JDO`) are configured with SAML and delivery options like FortiToken via mobile or email activation. During testing, various access sessions are launched, including SSH via PuTTY, WinSCP, Web SSH, Web SFTP, and Remote Desktop/Web RDP to targets such as `customer 2 Windows server`. - **Auto-Provisioning**: FortiPAM features auto-provisioning, which automatically generates privileges and grants access to secrets. - **Monitoring & Reporting**: FortiPAM logs connection metadata—including date, source IP, destination IP, secret server name, user, and launcher type. In addition to recording the actual session and commands executed, administrators can export general reports, user login reports, system reports, and secret launcher reports from the management portal.

### Takeaways The combination of FortiPAM, FortiAuthenticator Cloud, and FortiIdentity Cloud provides a unified IAM and PAM framework. It simplifies identity management across mixed identity providers while enforcing least privilege, zero-trust endpoint tagging, multi-factor authentication, and comprehensive session auditing.