after introduction of http_authd saml admin login don't work anymore

Forum|Forum|9 months ago
December 13, 2025
2 replies
458 views

using Administration login via SAML, custom keycloak server

config system saml
    set status enable
    set default-profile "no-permission"
    set entity-id "http://xxxxxx:8443/metadata/"
    set idp-entity-id "https://yyyyy/realms/realm_a"
    set idp-single-sign-on-url "https://yyyyy/realms/realm_a/protocol/saml"
    set idp-single-logout-url "https://yyyyy/realms/realm_a/protocol/saml"
    set idp-cert "keycloak-IDP"
    set server-address "xxxxxx:8443"
end

This always worked, but suddenly fortigate introduced `http_authd` in 7.6.4 and since then SAML admin login is broken.
just tested in 7.6.5 but same problem, had to downgrade to 7.6.3 which works fine, though it has a bug where SAML admin sso login session can't open the web terminal.

Best answer by zaxtron

I've found the cause of the problem.
This new authentication daemon http_authd introduced in 7.6.4 can't handle a large SAML Response payload from IDP (the size of the SAML document)
Our IDP was sending all the VPN roles/groups along in the SAML Response Assertion and that made the POST payload large +30kb and this crashes the http_authd daemon in fortigate.
That is also the reason nothing shows in the debug diagnoses, because the daemon crashes, thus making it difficult to debug.
We just removed the attribute with the VPN roles in the SAML response (it is not needed anyway for `config system saml`, they are only needed for `config user saml`) that reduced the SAML response payload and now it is working.
It is a bug in http_authd, I hope Fortigate fixes that sometime by allowing a large payload, or even at least handle this case and print in the debug logs that the payload size is too large instead of crash and print nothing

zaxtronAuthorAnswer

New Member

I've found the cause of the problem.
This new authentication daemon http_authd introduced in 7.6.4 can't handle a large SAML Response payload from IDP (the size of the SAML document)
Our IDP was sending all the VPN roles/groups along in the SAML Response Assertion and that made the POST payload large +30kb and this crashes the http_authd daemon in fortigate.
That is also the reason nothing shows in the debug diagnoses, because the daemon crashes, thus making it difficult to debug.
We just removed the attribute with the VPN roles in the SAML response (it is not needed anyway for `config system saml`, they are only needed for `config user saml`) that reduced the SAML response payload and now it is working.
It is a bug in http_authd, I hope Fortigate fixes that sometime by allowing a large payload, or even at least handle this case and print in the debug logs that the payload size is too large instead of crash and print nothing

funkylicious

SuperUser

out of curiosity since i didnt test keycloak for saml admin auth, can you share the client config in KC ? i'm interested in any mappers or settings for the client/FGT.

"jack of all trades, master of none"

Sign up

Login with SSO

Login to the community

Login with SSO