EMS Administrator SAML on 10443 gives 404 message

in System Settings > EMS Settings do you have enabled Open Port 10443 option ?

Only enforced when Windows Firewall is enabled. Port 10443 is also used for Invitation Email and SAML Authentication.

Hi ​@BraveITMan,

did you ever find a solution for this?
For the life of me I cannot figure this out, I think I want to achieve the same as you.

I want to use this for the User SAML auth and don’t want the admin web interface visible on the internet…..

Cheers!
-Simon

I’m sorry but you don’t seem to understand the problem. 

I have used all these guides, but what I want to achieve is that the EMS Web Console isn’t accessible from the internet. 

Thus I am trying to seperate it via ports. 443 → EMS Console 10443 SAML
 

The two features:

1. Administrator SAML SSO, under Administration > SAML SSO. This is admins logging into the EMS management console. EMS is the service provider and the Service Provider Settings expose the SP Address, SP Entity ID and SP ACS (login) URL. This ACS is served by the management console web service, i.e. the EMS console HTTPS port (443 by default). Fortinet
2. User Verification with SAML, under User Management > SAML Configuration. This lets end users authenticate against the IdP, such as Entra ID, and is what you use for group-based VPN profile assignment. This is endpoint-facing and runs on the 10443 service, not on the admin console. Fortinet

Why the 404 (BraveITMan):

Port 10443 is a separate service. The FortiClient EMS installation opens 8013 and 10443, and 10443 is used for invitation email and SAML authentication (the endpoint-facing kind), plus installer downloads. It does not register the administrator SSO ACS route. So when you set the SP Address to FQDN:10443, Entra completes its side correctly (hence "successful login" on the MS side), then redirects the browser to https://FQDN:10443/saml/default/<key>/acs, which does not exist on that listener, and you get "requested URL not found." This is by design, not a broken config. There is no config file on the Linux box where you can re-bind the admin ACS to 10443, so that approach is a dead end. FortinetFortinet Community

If your goal is to keep admin SSO but not expose 443 broadly, do not try to move it to 10443. Either restrict 443 by source (management subnet, jump host, or over VPN), or front EMS with a reverse proxy on a different external port that proxies to 443 internally while preserving the /saml ACS path, and set the SP Address to that proxy URL.

For Simon's goal (admin console off the internet, user SAML for VPN profiles):

You do not need the admin console (443) reachable from the internet at all. Your use case is User Verification SAML, which lives on the 10443 service, separate from the admin GUI. So publish 10443 externally (plus 8013 telemetry and FortiGuard outbound as your design requires) and keep 443 restricted to internal/management only. The statement that "the webUI needs to be accessible from the internet" applies to administrator SSO, where the ACS sits on the console port. It does not apply to user verification, where the ACS sits on 10443. That is precisely the port separation you were after.

Validation: open the SAML flow with browser dev tools and confirm which host:port the IdP redirect (ACS) targets, then make sure only that port is published. For Ubuntu endpoints this is the right path, since they cannot use the Entra ID device-based user verification and must go through the SAML user account flow.