Troubleshooting Tip: 'Invalid Request' error encountered during SAML SSO login with Keycloak

Description

This article explains the possible causes of the 'Invalid Request' error encountered during SSL VPN connections using SAML authentication with Keycloak as the Identity Provider (IdP).

Scope

FortiGate.

Solution

While connecting to the SSL VPN using FortiClient with SAML authentication with Keycloak IDP, the error 'Invalid Request' appears, as shown in the image below:

Web mode was enabled for testing purposes, and the same error was observed there as well.

This issue may occur if the SAML configuration on the FortiGate is incorrect. The configuration can be verified by reviewing the debug logs from the FortiGate CLI session.

diagnose debug application sslvpn -1

diagnose debug application samld -1

diagnose debug console timestamp enable

diagnose debug enable <----- Starts the debugging.

diagnose debug reset

diagnose debug disable 

The first thing to verify is that the 'config user saml' settings are correctly configured.

In this case, the issue appears to be related to the attribute configuration and certificate. Configure username as 'username' and group-name as 'group' under 'config user saml'

In Keycloak, navigate to the Keys tab under Realm Settings, download the default RSA certificate used for signing the IdP responses, and import the certificate into the FortiGate.

The certificate was imported into the FortiGate Identity Provider configuration under Single Sign-On, but the same error persists.

In this case, two possible solutions are available. One workaround is to navigate to the 'Settings' section of the client configuration in Keycloak and disable 'Client Signature Required'.

If the Keycloak team prefers not to disable 'Client Signature Required', enable the 'require-signed-resp-and-asrt' option under config user saml in FortiGate.

Then, enable the 'Fortinet_Factory' certificate in the Service Provider configuration under 'Single Sign-On' on the FortiGate, and import the certificate into Keycloak. Afterwards, the issue is resolved, and access to the Keycloak page is successful.