The following Fortinet Documents describe the configuration and validation steps when FortiAuthenticator acts as a SCIM client: FortiAuthenticator SCIM integration with AWS Technical Tip: User and group provisioning in AWS IAM Identity Center using FortiAuthenticator as SCIM Client
During initial deployments, FortiAuthenticator may log the following error events when it attempts to push User or Group updates to the SCIM Server.
 Figure 1. FortiAuthenticator GUI Event log showing failure status for POST request: Raw logs:
"POST user <username> failed with err code 0. Unable to connect to server, check connection and certificate."
Validate if the SCIM Server API endpoint is valid and responds to API requests.
For this test, use the command prompt from the local computer to contact the SCIM API endpoint by using Curl to retrieve the Users that are currently configured there. Any other API request can be used; the idea is to understand if the API endpoint is the correct one and if the Token is valid..
The SCIM Server API endpoint and the Token are normally provided during the initial SCIM Server provisioning.
C:\Users\****>curl -v --trace-ascii /dev/stdout https://scim.eu-central-1.amazonaws.com/XXXXX/scim/v2/Users -H "Authorization: Bearer <Security_Token"
Warning: --trace-ascii overrides an earlier trace/verbose option
* Host scim.eu-central-1.amazonaws.com:443 was resolved.
* IPv6: (none)
* IPv4: X.X.X.X, X.X.X.X, X.X.X.X
* Trying X.X.X.X:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* ALPN: server accepted http/1.1
* Established connection to scim.eu-central-1.amazonaws.com (X.X.X.X port 443) from xxxxx port 64320
* using HTTP/1.x
=> Send header, 768 bytes (0x300)
0000: GET /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/scim/v2/Users HTTP/1.1
0042: Host: scim.eu-central-1.amazonaws.com
0069: User-Agent: curl/8.19.0
0082: Accept: /
.
.
.
{"totalResults":2,XXXXXXXXX}* Connection #0 to host scim.eu-central-1.amazonaws.com:443 left intact
This shows that there is network connectivity and that the SCIM API endpoint and the Token used for access are valid.
Validate TLS Handshake between FortiAuthenticator and SCIM Server.
Initially, enable WAD debugs in FortiAuthenticator CLI:
diagnose system wad debug enable category rest_api
diagnose system wad debug enable category ssl
diagnose system wad debug enable category scim_client
diagnose system wad debug enable category scim_api
diagnose system wad debug enable level verbose
When finished, stop debugging:
diagnose system wad debug clear
It is recommended to also enable a Packet capture on the Firewall/Router for more details and have additional data to cross-check.
Recreate the issue in FortiAuthenticator by going to Authentication -> SCIM -> Service provider.
Select the IAM Identity Center entry and select 'Sync'.
Issues related to Certificate authentication will show the following errors:
2026-06-09T17:24:22.542947+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_port_caps_clt_server_name():7585 wsp=0x7f76a6dae060/1way_fgt_cert_client nego=0x7f76a6d04060 sni=scim.eu-central-1.amazonaws.com.
.
.
2026-06-09T17:24:22.561546+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_sock_port_in_ops_sync():13431 sp=0x7f76a6dae060/15 sync state=1 start
2026-06-09T17:24:22.561549+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_sock_port_exec_up_forward():13355 sp=0x7f76a6dae060/15
2026-06-09T17:24:22.561555+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_sock_port_exec_up_forward_txn():13335 sp=0x7f76a6dae060/15 forwarded len=1448
2026-06-09T17:24:22.561563+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_clt_on_server_hello():6898 wsp=0x7f76a6dae060/15 receive serverHello, ver=0304
2026-06-09T17:24:22.561567+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_port_caps_clt_ciphers():11215 sp=0x7f76a6dae060/15 ssl-svr=(nil)
2026-06-09T17:24:22.561571+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_clt_on_server_hello():6917 wsp=0x7f76a6dae060/15 full handshake with ses=(nil)
.
.
2026-06-09T17:24:22.562333+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_cert_auth_find():50 find wad_ssl_cert_auth_info, fail:0
2026-06-09T17:24:22.562336+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_cert_auth_find():65 Found auth_info!
2026-06-09T17:24:22.562339+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_port_caps_1way_clt_on_srv_certs():10299 sp=0x7f76a6dae060/15 client rcvd certs from server found cert=0x7f76a6c86060
2026-06-09T17:24:22.562344+02:00 fortiauth1 wad_14-0[1727]: [ssl] wad_ssl_port_caps_1way_clt_on_srv_certs():10392 sp=0x7f76a6dae060/15 cert auth failed
This shows that FortiAuthenticator does not trust the AWS certificate chain. It may be missing the root/intermediate CA in its trusted Certificate Authorities list.
To fix the issue, import the required certificates by learning them directly from the SCIM API endpoint.
Go to Certificate management-> Certificate Authorities-> Trusted CAs. Select 'Learn Certificate'. Learn the certificate by providing the SCIM API endpoint in the Hostname/IP field and the Port. Select 'Learn' and then 'Import' after giving any Certificate ID name to identify the newly imported certificates in FortiAuthenticator.
 Figure 2. Learning the Certificate chain from the SCIM Server API endpoint. After the certificates are successfully imported, validate again the User/group synchronization. Check the following document for more details on Trusted CAs. | 
