FortiCloud SAML authentication with Azure
I setup the SAML against our Azure according to the instructions provided in
Configure FortiClient EMS SAML with Azure... - Fortinet Community
I have been getting the error
IdP Response Error:
SAMLResponse must contain an InResponseTo element.
After a number of days with support on the latest version the SP is not replying with the InResponseTo element.
While struggling to set this up with no clear instructions available and being pushed to set this up with a Fortinet SE I am being told to sign a SAML certificate, however using the CA reloading the certificate in fails.
Below is the last reply from support regarding this issue and my next steps I am stuck on. Has anyone successfully configured the latest version 7.4.3.1926
"It seems based on the EMS version that you have and our analysis, it seems that support to allow for "Sign SAML AuthnRequest" has been removed from later versions of EMS.
Previously, this feature could be accessed through a checkbox, but in recent releases, the signing action is activated automatically whenever an SP certificate is imported in the Service Provider Settings of the EMS SAML configuration and is valid.
In your current setup, the uploaded certificate from Azure would most probably be in the IdP Certificate field (for Azure response authentication verification). Yet, to initiate AuthnRequest signing, you need to upload an SP certificate (with private key) in the SP Certificate field.
In that case;
- Please obtain or generate an appropriate certificate (with private key) for the service provider. It can be an internally generated self signed one or your internal CA issued certificate.
- Upload the certificate in the SP Certificate field in EMS.
Once this is done, EMS will automatically sign the SAML AuthnRequest, which should resolve the error for the missing InResponseTo field in Azure AD's SAML response.
Please Note:
Azure AD inserts "InResponseTo" attribute only when the incoming SAML AuthnRequest is signed. This is necessary for SP initiated login flows, such as those utilized by FortiClient and EMS.
