Troubleshooting Tip: How to resolve error code 'AADSTS75011'

Description

This article describes how to resolve the error code 'AADSTS75011' when FortiAuthenticator is the SAML IdP Proxy, and Azure is the Identity Provider.

Scope

FortiAuthenticator.

Solution

FortiAuthenticator is configured as an IdP Proxy, see SAML IdP proxy for Azure for reference.

The users will be redirected to the Microsoft login page:

After entering the credentials, the error code 'AADSTS75011' is displayed:

This error occurs because the default authentication context of FortiAuthenticator is 'PasswordProtectedTransport', which indicates that the IdP requires users to be authenticated using a password-based method, and the SAML application configured on Azure requires a different method.

To resolve this error, change the 'Authentication context' option on FortiAuthenticator. Go to Authentication -> Remote Auth. Servers -> SAML, select 'None' and save:

The 'None' option will omit the 'RequestedAuthnContext' assertion when an alternative to password-based authentication is used.