Troubleshooting Tip: SAML IPsec VPN Authentication fails with "Failed group matching" due to group buffer limits
| Description | This article describes a known issue where IPsec remote access VPN users using SAML authentication fail to connect despite having the correct group memberships.
When running the recommended debugs for VPN and authentication troubleshooting:
diagnose debug reset
The IdP assertion may correctly show the user's groups (e.g., Group_8 and Group_9:(
However, during the group composition stage, the FortiGate processes groups based on the order they are applied in firewall policies. If the internal buffer limit is reached, the list is truncated before it reaches the groups the user belongs to, resulting in a 'Failed group matching' error:
|
| Scope | FortiGate, FortiClient EMS. |
| Solution | This is a known issue caused by a buffer size limit that prevents loading the full group list. It is resolved in FortiOS 7.2.12, 7.4.8, and 7.6.3.
This ensures that the groups most users belong to are added to the internal evaluation buffer first, allowing them to be matched before the buffer limit is reached. |