Troubleshooting Tip: ZTNA Agentless Bookmarks are not showing when specifying group ID configuered with Azure
| Description | This article describes how to resolve the issue when the Bookmarks are not showing when group ID is specified, but it still works perfectly when the group is set to any. |
| Scope | FortiGate. |
| Solution | Follow the article below if bookmarks do not appear when accessing servers through ZTNA (agentless), as shown in the screenshot. The bookmarks are displayed only when the group is set to Any.
Partial configuration of FortiGate: config user saml edit "FortiZTNA" set entity-id "http://ztna.connect.com/remote/saml/metadata/" set single-sign-on-url "https://ztna.connect.com/remote/saml/login" set single-logout-url "https://ztna.connect.com/remote/saml/logout" set idp-entity-id "https://sts.windows.net/21ff43433a-4b0c-4084-8fd0-c9d7bb2df85b/" set idp-single-sign-on-url "https://login.microsoftonline.com/21ff9b343434a-4b0c-4086-8fd0-c9d7bb2df85b/saml2" set idp-single-logout-url "https://login.microsoftonline.com/21ff4343-4b0c-4086-8fd0-c9d7bb2df85b/saml2" set idp-cert "REMOTE_Cert_1" set user-name "username" set group-name "group" set digest-method sha1 set clock-tolerance 30 next end config firewall access-proxy-virtual-host edit "ztna-web-portal" set ssl-certificate "Root-certificate" set host "issa.connect.com" set client-cert disable next As shown below where the group ID is specified: config user group edit "ZTNA_SAML" set member "FortiZTNA" config match edit 1 set server-name "FortiZTNA" set group-name "e85832d6-131a-41e8-9d97-67efc6895d1c" next end next end Use the commands below and then generate the traffic to get the logs: diagnose wad debug enable all diagnose debug application samld -1 diagnose debug console timestamp enable diagnose wad debug enable category all diagnose wad debug enable level verbose diagnose wad debug display pid enable diagnose wad filter src x.x.x.x <----- Replace x.x.x.x with the source IP. diagnose debug enable Logs seen: [V]2026-02-04 11:24:35.794968 [p:3720][s:15681212][r:151010345] wad_http_marker_uri :1587 path=/remote/portal len=14 [V]2026-02-04 11:24:35.794970 [p:3720][s:15681212][r:151010345] wad_http_parse_host :1969 host_len=17 [I]2026-02-04 11:24:35.794972 [p:3720][s:15681212][r:151010345] wad_http_parse_host :2010 host=[17]connect.div82.com [I]2026-02-04 11:24:35.794975 [p:3720][s:15681212][r:151010345] wad_http_str_canonicalize :2543 enc=0 path=/remote/portal len=14 changes=0 [I]2026-02-04 11:24:35.794977 [p:3720][s:15681212][r:151010345] wad_http_str_canonicalize :2545 end=4 path=access=admin len=12 changes=0 [V]2026-02-04 11:24:35.794979 [p:3720][s:15681212][r:151010345] wad_http_normalize_uri :2751 host_len=17 path_len=14 query_len=12 [I]2026-02-04 11:24:35.794982 [p:3720][s:15681212][r:151010345] wad_http_req_detect_special :14476 captive_portal detected: false, preflight=(null) [V]2026-02-04 11:24:35.794984 [p:3720][s:15681212][r:151010345] wad_vs_web_portal_cookie_lookup :8953 decode cookie_str=4698F353B64E41AB90206E94D0AB1196 as cookie_val=1834651790, vd_id=1, vs_id=31, gwy_id=1 [I]2026-02-04 11:24:35.794987 [p:3720][s:15681212][r:151010345] wad_vs_proxy_match_web_portal_gwy_by_cookie:4541 31:ZTNA-web-proxy: found web portal cookie 0x7f613c1a6bc8, cookie_val=1834651790 [I]2026-02-04 11:24:35.794989 [p:3720][s:15681212][r:151010345] wad_vs_proxy_match_gwy :4613 31:ZTNA-web-proxy: matching gwy with vhost(ztna-web-portal) [V]2026-02-04 11:24:35.794991 [p:3720][s:15681212][r:151010345] wad_vs_proxy_match_vhost :4714 31:ZTNA-web-proxy: matching vhost by: issa.connect.com [V]2026-02-04 11:24:35.794993 [p:3720][s:15681212][r:151010345] wad_pattern_matcher_search :1225 pattern-match succ:connect.div82.com [I]2026-02-04 11:24:35.794995 [p:3720][s:15681212][r:151010345] wad_vs_proxy_match_vhost :4721 31:ZTNA-web-proxy: matched vhost(ztna-web-portal 0x7f613a9b0e18) [V]2026-02-04 11:24:35.794997 [p:3720][s:15681212][r:151010345] wad_vs_matcher_map_find :804 Empty matcher! [I]2026-02-04 11:24:35.794999 [p:3720][s:15681212][r:151010345] wad_vs_proxy_match_gwy :4658 31:ZTNA-web-proxy: Matched gwy(1) type(ztna-portal) via cookie 0x7f613c1a6bc8. [I]2026-02-04 11:24:35.795001 [p:3720][s:15681212][r:151010345] wad_vs_gwy_ztna_portal_get_wp :4286 31:ZTNA-web-proxy:1: trace [V]2026-02-04 11:24:35.795004 [p:3720][s:15681212][r:151010345] __wad_hauth_user_node_hold :2358 wad_ztna_portal_init_user_ctx (116): holding node 0x7f613c148f30 [I]2026-02-04 11:24:35.795006 [p:3720][s:15681212][r:151010345] wad_http_str_canonicalize :2543 enc=3 path=/remote/portal len=14 changes=0 [I]2026-02-04 11:24:35.795011 [p:3720][s:15681212][r:151010345] wad_vs_gwy_ztna_portal_get_wp :4286 31:ZTNA-web-proxy:1: trace [I]2026-02-04 11:24:35.795020 [p:3720][s:15681212][r:151010345] wad_ztna_portal_match_user :80 matched cached grp:NA [V]2026-02-04 11:24:35.795114 [p:3720][s:15681212][r:151010345] __wad_hauth_user_node_put :2369 wad_ztna_portal_user_ctx_close (77): putting node(ref=6) 0x7f613c148f30 [V]2026-02-04 11:24:35.795116 [p:3720][s:15681212][r:151010345] wad_http_req_exec_act :13680 response is ready! [V]2026-02-04 11:24:35.795118 [p:3720][s:15681212][r:151010345] wad_http_msg_start_setup_proc :2147 msg(0x7f6136e9f090) proc-setup started from: req_resp_ready. [V]2026-02-04 11:24:35.795120 [p:3720][s:15681212][r:151010345] wad_http_def_proc_msg_plan :2109 msg(0x7f6136e9f090) setting up processor(req_resp_ready) [V]2026-02-04 11:24:35.795122 [p:3720][s:15681212][r:151010345] wad_http_msg_start_setup_proc :2147 msg(0x7f613a7b8160) proc-setup started from: resp_forward. [V]2026-02-04 11:24:35.795124 [p:3720][s:15681212][r:151010345] wad_http_def_proc_msg_plan :2109 msg(0x7f613a7b8160) setting up processor(resp_forward) [I]2026-02-04 11:24:35.795126 [p:3720][s:15681212][r:151010345] wad_dump_fwd_http_resp :3133 hreq=0x7f6136e9f090 Forward response from Internal: The resolution for this issue is to ensure that the configuration highlighted in yellow matches the required settings, and that items 1 and 2 are configured as shown in the screenshot from the Azure side.  Note: User Attributes & Claims supports a single group claim per configuration. To add a new group claim, the existing user.groups [SecurityGroup] claim must be removed, or its scope must be updated to All groups. |
