Technical Tip: How to solve 'This sts.windows.net page can't be found' over SAML SSO

Description

This article describes how to solve the error 'This sts.windows.net page can't be found' after the 2FA page pops up when authenticating over SAML.

Scope

FortiGate, IPsec, SSO.

Solution

There are scenarios when connecting to a VPN with SAML authentication where the 2FA screen pops up, but the next error is shown: 'This sts.windows.net page can't be found'.

The error means the URL 'IdP single sign-on URL' used by the IdP is wrongly configured on the FortiGate.

This can be verified using the next command:

FGT_TEST # config user saml
FGT_TEST (saml) # edit "XXXXXX"
FGT_TEST (XXXXXX) # show

Inside the 'XXXXX', specify the name of the SAML user profile, which can also be identified by going to User and authentication -> Single Sign-On, and the name of the profile is shown there:

Check the URL and see if it is wrong:

Correct URL that needs to be verified on the IdP side and also an example on the FortiGate side:

After the URL is fine, the issue should be fixed and not persist.