Technical Tip: SSL VPN SAML Authentication failure due to missing SAML Metadata on FortiGate

SSL VPN users using SAML authentication fail to connect in both tunnel mode and web mode. The following errors appear in the SAML debug logs:

diagnose debug application samld -1
diagnose debug enable
gen_sp_server [309]: Failed to create SP
samld_send_common_reply [91]: Code: 1, id: 3021, pid: 24468, len: 16, data_len 0
samld_send_common_reply [119]: Sent resp: 16, pid=24468, job_id=3021.
samld_process_request [145]: len=457, cmd=0, pid=24469, job_id=3021
samld_process_request [162]: Received 457, 0x1919670

It is observed that the saml metadata file gets deleted and the UDP kernel socket 8900 is bound to the hatalk daemon instead of sslvpnd process.
Since port 8900 is occupied by another daemon (in this case, hatalk), the first child process of sslvpnd fails to start.

This process is responsible for creating the SAML metadata when all sslvpnd processes are restarted. As a result, the SAML metadata cannot be generated, which can be verified using the following commands:

diagnose vpn ssl saml-metadata <SAML name>
stat('/dev/cmdb/.hidden/sslvpn/tmp/0-saml-sp-meta.xml') failed: No such file or directory

diagnose system udpsock | grep 8900
127.0.0.1:8900->127.0.0.1:701 state=established txq=0 rxq=0 uid=0 inode=5873800 process=10226/hatalk

This issue has been resolved in FortiOS versions 7.4.8 and 7.6.3.

Workaround 1:
Delete and reconfigure the SAML configuration. The issue may resurface if FortiGate is rebooted or the sslvpnd daemons are restarted.

Note:

SAML metadata is also not generated when the configuration has an incorrect/invalid idp-cert.

Workaround2:
Change FortiGate's daemon port range. This will require a reboot of the FortiGate:

config sys global
    set ip-src-port-range 10000-65535
end

General debug information required by FortiGate TAC for investigation:

1. Debugs:

diagnose debug application samld -1
diagnose debug application sslvpn -1
diagnose debug application fnbamd -1
diagnose debug console timestamp enable
diagnose debug enable

Reproduce the issue,

diagnose debug disable

diagnose debug reset

diagnose vpn ssl saml-metadata <SAML name>
diagnose ip udp list
diagnose sys udpsock
fnsysctl ps

2. TAC Report:

execute tac report

3. Configuration file of the FortiGate.