Technical Tip: FortiCloud SSO request rejected after HA failover due to a serial number mismatch

Description

This article describes a known issue that causes FortiCloud SSO authentication to fail after an HA failover due to a FortiGate serial number mismatch.

Scope

FortiGate v7.2, v7.4, v7.6, and v8.0.

Solution

This issue can occur after FortiCloud SSO has been enabled on a FortiGate High-Availability (HA) cluster that appears in sync. After an HA failover, when performing FortiCloud SSO authentication, the BIOS certificate on the secondary FortiGate is used to generate the SSO request, while the SSO daemon continues running on the primary FortiGate.

When the primary FortiGate validates the serial number contained in the SSO IdP response, it detects a mismatch between the serial number associated with the SSO request and its own serial number. As a result, the primary FortiGate rejects the SSO authentication request, causing the user login to fail.

To confirm the behavior, run the following commands and gather a sample of SAML/HTTPS debug logs on the FortiGate while performing a FortiCloud SSO-based login attempt:

diagnose debug reset
diagnose debug application httpsd -1
diagnose debug application samld -1
diagnose debug console timestamp enable
diagnose debug enable

This behavior is tracked by Issue 1286934 and will be resolved as of FortiOS versions v7.4.13, v7.6.7, and v8.0.1 (see also: Resolved issues). No workaround is currently available.

Related article:

Technical Tip: How to access a firewall using FortiOS SSO