Forticlient - SAML Authentication - Pick an account option missing

Forum|Forum|2 years ago
October 26, 2023
9 replies
6469 views

I am using Fortclient 7.0.8.427 using Azure SAML for sign-in.

All works except for some users, when authenicating, they get the option to click on thier email address from the In Browser window that appears.

For others, the have to always enter in their email address.

Has anyone seen this?

Checked Credential Manager and cleared out the cache in MS Egde the default browser but no success.

Has anyone seen this?

Enter email.png Pick an account.png

Best answer by mle2802

Hi @Icebun,
You can modify this option on EMS VPN profile "<dont_modify_cookies>1</dont_modify_cookies>". However, this will push for all users. Try to test it with test machine and free FortiClient version before pushing from EMS server.

mle2802

Staff

Hi @Icebun,

Can you try to use external browser for authentication. Please refer to this document for more information "https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/364443/using-a-browser-as-an-external-user-agent-for-saml-authentication-in-an-ssl-vpn-connection"

Regards,
Minh

IcebunAuthor

Explorer II

Hi @Minh

Thanks for the response.

I did see the option to use a browser as an external agent within EMS itself, which I presume stands a better chance of caching the email address part of the credentials. Is that right?

Looking at the information sent, this looks like it will need changes at the Fortigate FW as well?

Is that true? If so, how can I test this as we have a large number of VPN users and do not want to change the behaviour if I am not successful (as some users works fine and there email address caches ok).

Is there no other way?

mle2802

Staff

Hi @Icebun,

This option is configured on Client not on FortiGate. You can download VPN only version on test machine and configure VPN instead of pushing using EMS. Also, in FortiClient setting, there is an option call "do not modify internal browser cookies", can you try that before using external browser?

Regards,
Minh

Sign up

Login with SSO

Login to the community

Login with SSO