Visitor III

Question

Azure SAML WiFi Authentication Cert Trust Error

Forum|Forum|3 years ago
July 12, 2023
13 replies
8616 views

I was following the guide to setup WiFi authentication using Azure and SAML IdP from the Fortinet community here

The authentication does work, but it gives a certificate error when connecting. If you trust the cert the authentication goes through and works. The below error message is seen when using the Fortinet Factory cert.

Azure-SAML-Fortinet-Cert (2).png

The following error is observed when using a CA cert from Let's Encrypt.

The intended use is for this network to be used for personal cell phones of company employees. So I do not want employees to have download or trust anything on their devices when connecting to the network.

If it is not possible to avoid the cert trust error please let me know. Otherwise below is what I have tried to get it to work.

The documentation mentions using a CA certificate and redirecting the auth portal page. However, whenever I redirect the portal it breaks the authentication. I have tired adding the redirection in both the GUI and CLI and various certs, neither works.

Based on the error it seems that the cert error is occurring because the authentication request is coming from the internal IP of the subnet and not the FQDN of the cert. However as mentioned anytime I redirect the portal page it breaks the authentication. (Yes, I updated the Azure App and Fortinet URL's to reflect the redirected address, but it still broke the authentication).

I am still pretty new to certs and stuff so I am probably missing something and help is appreciated.

ndumaj

Staff

Hello,

The certificate you are using cannot be verified, i see that you are using the IP instead of FQDN, maybe IP is not added as SAN(Subject Alternative Name).
For unmanaged devices you should use public certificate authorities (for example GlobalSign, Gigicert ... ) to avoid Cert warning.
Please review the following articles:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-TLS-and-the-use-of-Digital-Certificates/ta-p/214958
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Fixing-the-error-Certificate-file-is/ta-p/196187
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-generate-wildcard-CSR/ta-p/195414
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-avoid-certificate-error-message-by-chaining/ta-p/196605.

BR

kylehoukAuthor

Visitor III

To get the certificate to be seen as valid I had to setup the local DNS server on the Fortigate and enable it on the interface for the network where I want the certificate to be valid.

OscarDNL

Visitor III

Im having same issue, could u please explain more datailed what you did?
pls

kylehoukAuthor

Visitor III

On the Fortigate I created a new recursive DNS service on the interface where I need users to authenticate using SAML. Then I created a new DNS database. I called the DNS Zone "Internal Domains" as the name. For the Domain Name I set it to the same domain as certificate uses.

Next I created DNS A record entry pointing to the IP of the firewall on the same vlan as the DNS server I created earlier.

For example, if the certificate you were planning to use is saml.example.com on a subnet of 10.0.0.0/24 with the router IP of 10.0.0.1 I would configure the DNS as follows:

Create a new DNS database with Domain Name of example.com on the interface that has the 10.0.0.0/24 subnet. I would then create a DNS A record of saml pointing to the IP of 10.0.0.1 Finally on the 10.0.0.0/24 interface set the DNS server to be same as interface IP. This will set the DNS server IP sent to DHCP clients as the Fortigate itself.

Now when you are prompted to do SAML auth the IP address matches the certificate, and it doesn't throw the error.

OscarDNL

Visitor III

It worked! thank you so much

Gcordoba1609

New Member

Could you elaborate a little more, I'm not very good with certificates, how do you generate them?

kylehoukAuthor

Visitor III

Have you setup a custom Azure/Entra ID application for use for the FortiGate yet?
Do you have a custom domain?
Do you have a static IP or the ability to link a DHCP IP with your custom domain?

Gcordoba1609

New Member

Have you setup a custom Azure/Entra ID application for use for the FortiGate : YES

I'll tell you my problem. I have the SAML issue already configured and working, but I have the certificate warning issue every time users try to connect because they can't find a valid certificate.
According to what the Fortinet people tell me, I must create a wildcard certificate since I have validation in several VLANs according to the connection that is made. And that's the part that I don't understand how to do.

Regards

Sign up

Login with SSO

Login to the community

Login with SSO