Troubleshooting Tip: FortiSASE endpoints cannot connect to VPN using SAML

SAML logs show successful authentication followed by an immediate logout.

The lockdown grace period for endpoints was set to zero seconds. This caused FortiClient to fail during the transition phase, as the endpoint did not have sufficient time to complete SAML authentication.

Fix:

Update the lockdown grace period to 120 seconds. This value provides enough time for the authentication process to complete successfully. After applying this configuration, VPN connections using SAML authentication were established successfully. As shown in the below screenshot, Go to Endpoint profile -> Select the Profile name -> Select 'Connection' and change the value of the Grace period from zero to 120 Seconds.