Skip to main content
funkylicious
SuperUser
funkylicious
SuperUser
January 20, 2025
Solved

7.0.17 - breaking SAML

  • January 20, 2025
  • 5 replies
  • 5941 views

Hi,

 

Anyone else noticing issues with login to SSLVPN using SAML with Entra after upgrade to 7.0.17 for users with FortiClient 7.4.X ?

 

Did an upgrade on FOS to a client and it broke the connection for newer versions butwith FortiClient 7.2.X it appears to work just fine and it used to work also with this version up until upgraded .


A similar issue was also brought up here 

Best answer by JL1

same experience.  Users required to offload saml to external browser. 
Pushed to 7.2.10 as EoES was mentioned in my support ticket 

5 replies

wedniaa2
wedniaa2
New Member
January 20, 2025

A simple advice would be to bump yourself up to FortiOS 7.0 and start using external browser for SAML logins. Then you can offload all the cookie shenanigans and username/pwd saving to your default browser, and stop caring what FortiClient makes or breaks next.

AEK
SuperUser
AEK
SuperUser
January 20, 2025

Hi @funkylicious 

I guess they broke something when they fixed the below in 7.0.17.

1101837

Insufficient Session Expiration in SSLVPN using SAML authentication.

The issue now is that they "may" not fix it in 7.0.x anymore since it is EoES.

AEK
    JL1
    JL1Answer
    New Member
    January 20, 2025

    same experience.  Users required to offload saml to external browser. 
    Pushed to 7.2.10 as EoES was mentioned in my support ticket 

      funkylicious
      SuperUser
      funkyliciousAuthor
      SuperUser
      January 21, 2025

      Thanks for your input guys.

      Have a nice day!

      "jack of all trades, master of none"
      sferoz
      Staff
      sferoz
      Staff
      January 21, 2025

      We are working on this issue and created an engineering ticket #1117475 for tracking, can you help share the config file, FCT and FGT debug logs, TAC case number if any to sferoz@fortinet.com for more investigation.

       

        sferoz
        Staff
        sferoz
        Staff
        March 18, 2025

        The issue related to SAML #1117475 when using FCT internal browser as user-agent for saml user authentication with SAML debugs showing "could not found corresponding saml session 101" is resolved in upcoming FCT 7.4.3.

        JL1
        JL1
        New Member
        March 20, 2025

        Our org also observed this same behavior on FortiOS 7.4.7 (now the recommended release). 
        Interesting that the potential fix is on the Forticlient, but the issue is induced by different versions of FortiOS on Fortigate. 

        Terms & ConditionsAccessibility statement