Skip to main content
AntoineCOSTA
AntoineCOSTA
New Member
April 4, 2023
Question

FortiClient 7.0.8.0427 SAML authentication not Cached

  • April 4, 2023
  • 5 replies
  • 15432 views

Hi, with the new Forticlient version SAML authentication is no longer cached.

Before the update, we were in 7.0.7.0345 and after the first SAML authentication, the data was cached and the user did not have to reauthenticate several times

during the day.

We erase cookies when the machine is shut down.

 

Is it possible to re-enable this feature?

Or is it possible to download a complete last version (7.0.7.0345)?

    5 replies

    maxs
    maxs
    Explorer
    April 6, 2023

    It was a bug in 707 that was fixed in 708. If you want caching. then switch to using external browser for SAML auth.

    pfournier
    pfournier
    Explorer III
    May 31, 2023

    So is this not being fixed? We had been using this for the last few years with zero issues, but now its a pain unless external browser is enabled. 

     

    The SSO popup gives you an option to keep me signed in, but it doesn't actually work. 

    mhberglund
    mhberglund
    Visitor III
    June 29, 2023

    We are also experiencing the same issue with FortiClient VPN 7.0.8.0427

    The "Stay Signed in" feature offered by Azure Active Directory authentication is ignored and users have to reauthenticate each time they login to FortiClient VPN.

    Still working with version 7.0.7.0345.

     

    We have not got the "Use external browser as user-agent for saml user authentication" to work with either 7.0.7.0345 or 7.0.8.0427.

     

    I have also contacted Microsoft support as I initially thought it was an issue with Azure Active Directory authentication. They are analysing the HTTPS traffic to also assist in the troubleshooting steps. Will report back if the issue can be resolved.

    pminarik
    Staff
    pminarik
    Staff
    June 29, 2023

    The behaviour has changed over time.

     

    6.4 branch: cookie(s) never cached

    7.0.0~7.0.7: cookie(s) always cached

    This would never keep everyone happy, so starting from 7.0.8 the behaviour was changed to follow the state of the "save password" option. If it is checked, the SAML IdP cookie is cached and reused during the next login (assuming that it is still valid by that time).

     

    https://docs.fortinet.com/document/forticlient/7.0.8/windows-release-notes/22791/resolved-issues

    744544 - "FortiClient (Windows) always saves SAML credentials."

    The title/description doesn't explicitly call out the new behaviour, so you will have to trust me on that. If you're observing behaviour that is different, you should report it to TAC as a (most likely) bug.

      mhberglund
      mhberglund
      Visitor III
      June 30, 2023

      Hi @pminarik 

      Thank you for the reply and clarification of the default behaviour of the different versions of FortiClient VPN.

      When you mentioned "save password" option, did you mean the 3rd party Single Sign On service offering an option to save the password? I do not see this as an option explicitly in the FortiClient VPN app.

      pminarik
      Staff
      pminarik
      Staff
      June 30, 2023

      I meant the "Save Password" checkbox in FortiClient, as shown for example here: https://docs.fortinet.com/document/forticlient/7.2.1/administration-guide/437773/save-password-auto-connect-and-always-up

       

      However, now that I think about it, I suspect that this may be one of the features that are only available in EMS-managed clients, not in the free version.

       

      If you're using the "external browser" option to handle SAML through your regular browser, then the caching of credentials/cookies would be fully in control of the browser itself.

        techdsmart
        techdsmart
        New Member
        November 18, 2023

        Did anyone found a solution to this? I am using EMS Version 7.2.2 build 0879. SAML option with Azured IdP was working well in caching username with FortiClient v7.0.7. Trying to upgrade to higher versions, suddenly username is not cached. Same issue on v7.0.8, 7.0.9 and v7.2.1 & 7.2.2.

        Running out of luck on which versions supports username caching with SAML since its annoying that users have to enter both their username and password every time they connect to VPN.

        FYI, we using internal browser for saml authentications and this is my ssl vpn options xml

         

        <?xml version="1.0" ?> <forticlient_configuration> 	<vpn> 		<enabled>1</enabled> 		<sslvpn> 			<options> 				<enabled>1</enabled> 				<dnscache_service_control>0</dnscache_service_control> 				<prefer_sslvpn_dns>1</prefer_sslvpn_dns> 				<disallow_invalid_server_certificate>0</disallow_invalid_server_certificate> 				<warn_invalid_server_certificate>1</warn_invalid_server_certificate> 				<keep_connection_alive>1</keep_connection_alive> 				<preferred_dtls_tunnel>0</preferred_dtls_tunnel> 				<no_dns_registration>0</no_dns_registration> 				<dont_modify_cookies>1</dont_modify_cookies> 				<negative_split_tunnel_metric/>

         

         

        Terms & ConditionsAccessibility statement