Troubleshooting Tip: Error 'app_not_configured_for_user' when using Google SAML as IdP for SSL VPN

The following error is encountered:

Verify the IdP and SAML settings are identical on FortiGate and on G-Suite as below:

Customize the configuration:

idp-entity-id                -> 'Entity ID' copy form google console.

idp-single-sign-on-url -> 'SSO URL' copy form google console.

idp-single-logout-url   -> 'https://accounts.google.com/logout'.

User SAML.

config user saml

    edit "gsuite-sslvpn"

        set cert "Fortinet_Factory"
        set entity-id "https://<FGT-pub-IP>:<port-ssl-vpn>/remote/saml/metadata/"
        set single-sign-on-url "https://<FGT-pub-IP>:<port-ssl-vpn>/remote/saml/login/"
        set single-logout-url "https://<FGT-pub-IP>:<port-ssl-vpn>/remote/saml/logout/"
        set idp-entity-id "https://accounts.google.com/o/saml2?idpid="
        set idp-single-sign-on-url "https://accounts.google.com/o/saml2/idp?idpid="

        set idp-single-logout-url "https://accounts.google.com/logout" 
        set idp-cert "REMOTE_Cert_1"
        set user-name "Username"
        set group-name "group"  
        set digest-method sha1

    next

end

Once this is verified, ensure that "User access" status is "ON" for everyone as per the image below.

Navigation: Menu -> Apps -> Web and mobile apps (or Google Workspace).
Action: Select the specific application, then select Service status to turn it ON or OFF for specific Organizational Units (OUs) or Groups.

If the user access status is 'OFF' or 'NOT CONFIGURED', then users might face the above error even though authentication is successful.

Related article:

Technical Tip: Fortinet SSL VPN with G Suite MFA using SAML and SSO