Skip to main content
rslygh
rslygh
New Member
February 7, 2025
Solved

Azure SAML SSO prompts to login every time in Forticlient VPN 7.2 and 7.4

  • February 7, 2025
  • 3 replies
  • 9169 views

Every time one of our users attempts to login, they are prompted to provide all their credentials. We're using Forticlient VPN (free). The connection is established and works, but on the next login it prompts for the Microsoft login again. This began happening in Forticlient 7.2 and has continued in Forticlient 7.4. This does NOT happen in Forticlient 7.0, so we're still using Forticlient 7.0 in production.

 

The Fortigate itself has been on various flavors of FortiOS 7.0, 7.2, and 7.4, and the results have been the same for Forticlient.

 

Our Azure accounts are setup with MFA, and we're using SSL-VPN in tunnel-only mode.

 

Forticlient 7.0 - connecting with Azure SSO works fine without reprompting for credentials and without needing to change any of the default Forticlient settings

 

Forticlient 7.2 - connecting with Azure SSO works, but prompts for credentials every login regardless of whether you tell it to remember credentials and MFA authorization or not. 

 

Forticlient 7.4 - connecting with Azure SSO works, but prompts for credentials every login regardless of whether you tell it to remember credentials and MFA authorization or not when using the default Forticlient settings. If you get to the "Stay signed in" box during the Microsoft login and check the box for "Don't show again" and answer Yes, it fails and you get a -7200 error from Forticlient. I found that if I edit the connection itself and check "Use external browser as user-agent for saml user authentication", then it does appear to log in without requesting new credentials

 

Has anyone else ran into this, or have any ideas? For now I'll keep using v7.0, but I've had this issue for a long time and the newer Forticlient versions have yet to resolve it so I'm looking for any help to figure out what might be going on before they stop releasing new v7.0 versions.

Best answer by MZBZ

Check "AzureAdJoined devices" section of the following KB. You should use Windows Form WebBrowser Control as Internal Browser for seamless Azure SAML login IF the device is AzureAdJaoined or has the account registered in the Work or School. Article exlains in detail.

 

https://community.fortinet.com/t5/FortiClient/Technical-Tip-FortiClient-SAML-Authentication-Configuration/ta-p/369318#:~:text=AzureAdJoined%20devices%3A

 

3 replies

Andrzej_PL
Andrzej_PL
Visitor III
February 7, 2025

Hi,

set options as in the screenshots

fgf1.jpgfgf2.jpg

rslygh
rslyghAuthor
New Member
February 7, 2025

Doesn't work. I found this KB article related to the "Do not modify internal browser cookies" checkbox earlier and tried it before posting, but no luck. Here are the results I see when doing what you're suggesting (with the use external browser unchecked in the connection settings)

 

Both checked = immediate -7200 error without any credential prompt

Save Password only checked = credential prompt opens

Do not modify internal browser cookies only checked = credential prompt opens

 

Having "Do not modify internal browser cookies" checked does prevent the -7200 error from happening later in the credential entry process on the "Stay signed in" page (checking Don't ask again and clicking Yes triggers a -7200 with default settings), but it still requires going through the full login process every time

 

The only workaround I've found so far that seems to work is the "Use external browser as user-agent for saml user authentication" being checked within the connection configuration

Andrzej_PL
Andrzej_PL
Visitor III
February 7, 2025

maybe this user has his browser permanently set to incognito mode?

MZBZ
Staff
MZBZAnswer
Staff
February 8, 2025

Check "AzureAdJoined devices" section of the following KB. You should use Windows Form WebBrowser Control as Internal Browser for seamless Azure SAML login IF the device is AzureAdJaoined or has the account registered in the Work or School. Article exlains in detail.

 

https://community.fortinet.com/t5/FortiClient/Technical-Tip-FortiClient-SAML-Authentication-Configuration/ta-p/369318#:~:text=AzureAdJoined%20devices%3A

 

rslygh
rslyghAuthor
New Member
January 19, 2026

Kind of a dead thread, but I ran across it while coming back to this issue and admittedly didn't realize it was my thread at the beginning. For anyone else that runs across this, I still had this issue and had not figured it out, but came back to it today. Devices are not AzureAdJoined joined, but do have an account setup under "Access work or school".

 

The link above from MZBZ regarding Windows Form WebBrowser looks to have been the key. The default settings do not appear to set that as active. Working with the latest version of Forticlient (hotfix 7.4.3.8758), both config settings mentioned in that link needed to be updated to force the WebBrowser control to be used: 

 

<after_logon_saml_auth>2</after_logon_saml_auth>
<before_logon_saml_auth>2</before_logon_saml_auth>

 

After setting those and restoring the configuration, Forticlient stopped prompting for the Microsoft credentials every time I connected. I need to expand my test group, but this seems promising.

Terms & ConditionsAccessibility statement